git.squeep.com Git - akkoma/blob - test/web/activity_pub/activity_pub_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
   6   use Pleroma.Web.ConnCase
   7   use Oban.Testing, repo: Pleroma.Repo
   8
   9   import Pleroma.Factory
  10   alias Pleroma.Activity
  11   alias Pleroma.Config
  12   alias Pleroma.Delivery
  13   alias Pleroma.Instances
  14   alias Pleroma.Object
  15   alias Pleroma.Tests.ObanHelpers
  16   alias Pleroma.User
  17   alias Pleroma.Web.ActivityPub.ObjectView
  18   alias Pleroma.Web.ActivityPub.Relay
  19   alias Pleroma.Web.ActivityPub.UserView
  20   alias Pleroma.Web.ActivityPub.Utils
  21   alias Pleroma.Web.CommonAPI
  22   alias Pleroma.Workers.ReceiverWorker
  23
  24   setup_all do
  25     Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
  26     :ok
  27   end
  28
  29   setup do: clear_config([:instance, :federating], true)
  30
  31   describe "/relay" do
  32     setup do: clear_config([:instance, :allow_relay])
  33
  34     test "with the relay active, it returns the relay user", %{conn: conn} do
  35       res =
  36         conn
  37         |> get(activity_pub_path(conn, :relay))
  38         |> json_response(200)
  39
  40       assert res["id"] =~ "/relay"
  41     end
  42
  43     test "with the relay disabled, it returns 404", %{conn: conn} do
  44       Config.put([:instance, :allow_relay], false)
  45
  46       conn
  47       |> get(activity_pub_path(conn, :relay))
  48       |> json_response(404)
  49     end
  50
  51     test "on non-federating instance, it returns 404", %{conn: conn} do
  52       Config.put([:instance, :federating], false)
  53       user = insert(:user)
  54
  55       conn
  56       |> assign(:user, user)
  57       |> get(activity_pub_path(conn, :relay))
  58       |> json_response(404)
  59     end
  60   end
  61
  62   describe "/internal/fetch" do
  63     test "it returns the internal fetch user", %{conn: conn} do
  64       res =
  65         conn
  66         |> get(activity_pub_path(conn, :internal_fetch))
  67         |> json_response(200)
  68
  69       assert res["id"] =~ "/fetch"
  70     end
  71
  72     test "on non-federating instance, it returns 404", %{conn: conn} do
  73       Config.put([:instance, :federating], false)
  74       user = insert(:user)
  75
  76       conn
  77       |> assign(:user, user)
  78       |> get(activity_pub_path(conn, :internal_fetch))
  79       |> json_response(404)
  80     end
  81   end
  82
  83   describe "/users/:nickname" do
  84     test "it returns a json representation of the user with accept application/json", %{
  85       conn: conn
  86     } do
  87       user = insert(:user)
  88
  89       conn =
  90         conn
  91         |> put_req_header("accept", "application/json")
  92         |> get("/users/#{user.nickname}")
  93
  94       user = User.get_cached_by_id(user.id)
  95
  96       assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
  97     end
  98
  99     test "it returns a json representation of the user with accept application/activity+json", %{
 100       conn: conn
 101     } do
 102       user = insert(:user)
 103
 104       conn =
 105         conn
 106         |> put_req_header("accept", "application/activity+json")
 107         |> get("/users/#{user.nickname}")
 108
 109       user = User.get_cached_by_id(user.id)
 110
 111       assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
 112     end
 113
 114     test "it returns a json representation of the user with accept application/ld+json", %{
 115       conn: conn
 116     } do
 117       user = insert(:user)
 118
 119       conn =
 120         conn
 121         |> put_req_header(
 122           "accept",
 123           "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
 124         )
 125         |> get("/users/#{user.nickname}")
 126
 127       user = User.get_cached_by_id(user.id)
 128
 129       assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
 130     end
 131
 132     test "it returns 404 for remote users", %{
 133       conn: conn
 134     } do
 135       user = insert(:user, local: false, nickname: "remoteuser@example.com")
 136
 137       conn =
 138         conn
 139         |> put_req_header("accept", "application/json")
 140         |> get("/users/#{user.nickname}.json")
 141
 142       assert json_response(conn, 404)
 143     end
 144
 145     test "it returns error when user is not found", %{conn: conn} do
 146       response =
 147         conn
 148         |> put_req_header("accept", "application/json")
 149         |> get("/users/jimm")
 150         |> json_response(404)
 151
 152       assert response == "Not found"
 153     end
 154
 155     test "it requires authentication if instance is NOT federating", %{
 156       conn: conn
 157     } do
 158       user = insert(:user)
 159
 160       conn =
 161         put_req_header(
 162           conn,
 163           "accept",
 164           "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
 165         )
 166
 167       ensure_federating_or_authenticated(conn, "/users/#{user.nickname}.json", user)
 168     end
 169   end
 170
 171   describe "/objects/:uuid" do
 172     test "it returns a json representation of the object with accept application/json", %{
 173       conn: conn
 174     } do
 175       note = insert(:note)
 176       uuid = String.split(note.data["id"], "/") |> List.last()
 177
 178       conn =
 179         conn
 180         |> put_req_header("accept", "application/json")
 181         |> get("/objects/#{uuid}")
 182
 183       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
 184     end
 185
 186     test "it returns a json representation of the object with accept application/activity+json",
 187          %{conn: conn} do
 188       note = insert(:note)
 189       uuid = String.split(note.data["id"], "/") |> List.last()
 190
 191       conn =
 192         conn
 193         |> put_req_header("accept", "application/activity+json")
 194         |> get("/objects/#{uuid}")
 195
 196       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
 197     end
 198
 199     test "it returns a json representation of the object with accept application/ld+json", %{
 200       conn: conn
 201     } do
 202       note = insert(:note)
 203       uuid = String.split(note.data["id"], "/") |> List.last()
 204
 205       conn =
 206         conn
 207         |> put_req_header(
 208           "accept",
 209           "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
 210         )
 211         |> get("/objects/#{uuid}")
 212
 213       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
 214     end
 215
 216     test "it returns 404 for non-public messages", %{conn: conn} do
 217       note = insert(:direct_note)
 218       uuid = String.split(note.data["id"], "/") |> List.last()
 219
 220       conn =
 221         conn
 222         |> put_req_header("accept", "application/activity+json")
 223         |> get("/objects/#{uuid}")
 224
 225       assert json_response(conn, 404)
 226     end
 227
 228     test "it returns 404 for tombstone objects", %{conn: conn} do
 229       tombstone = insert(:tombstone)
 230       uuid = String.split(tombstone.data["id"], "/") |> List.last()
 231
 232       conn =
 233         conn
 234         |> put_req_header("accept", "application/activity+json")
 235         |> get("/objects/#{uuid}")
 236
 237       assert json_response(conn, 404)
 238     end
 239
 240     test "it caches a response", %{conn: conn} do
 241       note = insert(:note)
 242       uuid = String.split(note.data["id"], "/") |> List.last()
 243
 244       conn1 =
 245         conn
 246         |> put_req_header("accept", "application/activity+json")
 247         |> get("/objects/#{uuid}")
 248
 249       assert json_response(conn1, :ok)
 250       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 251
 252       conn2 =
 253         conn
 254         |> put_req_header("accept", "application/activity+json")
 255         |> get("/objects/#{uuid}")
 256
 257       assert json_response(conn1, :ok) == json_response(conn2, :ok)
 258       assert Enum.any?(conn2.resp_headers, &(&1 == {"x-cache", "HIT from Pleroma"}))
 259     end
 260
 261     test "cached purged after object deletion", %{conn: conn} do
 262       note = insert(:note)
 263       uuid = String.split(note.data["id"], "/") |> List.last()
 264
 265       conn1 =
 266         conn
 267         |> put_req_header("accept", "application/activity+json")
 268         |> get("/objects/#{uuid}")
 269
 270       assert json_response(conn1, :ok)
 271       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 272
 273       Object.delete(note)
 274
 275       conn2 =
 276         conn
 277         |> put_req_header("accept", "application/activity+json")
 278         |> get("/objects/#{uuid}")
 279
 280       assert "Not found" == json_response(conn2, :not_found)
 281     end
 282
 283     test "it requires authentication if instance is NOT federating", %{
 284       conn: conn
 285     } do
 286       user = insert(:user)
 287       note = insert(:note)
 288       uuid = String.split(note.data["id"], "/") |> List.last()
 289
 290       conn = put_req_header(conn, "accept", "application/activity+json")
 291
 292       ensure_federating_or_authenticated(conn, "/objects/#{uuid}", user)
 293     end
 294   end
 295
 296   describe "/activities/:uuid" do
 297     test "it returns a json representation of the activity", %{conn: conn} do
 298       activity = insert(:note_activity)
 299       uuid = String.split(activity.data["id"], "/") |> List.last()
 300
 301       conn =
 302         conn
 303         |> put_req_header("accept", "application/activity+json")
 304         |> get("/activities/#{uuid}")
 305
 306       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: activity})
 307     end
 308
 309     test "it returns 404 for non-public activities", %{conn: conn} do
 310       activity = insert(:direct_note_activity)
 311       uuid = String.split(activity.data["id"], "/") |> List.last()
 312
 313       conn =
 314         conn
 315         |> put_req_header("accept", "application/activity+json")
 316         |> get("/activities/#{uuid}")
 317
 318       assert json_response(conn, 404)
 319     end
 320
 321     test "it caches a response", %{conn: conn} do
 322       activity = insert(:note_activity)
 323       uuid = String.split(activity.data["id"], "/") |> List.last()
 324
 325       conn1 =
 326         conn
 327         |> put_req_header("accept", "application/activity+json")
 328         |> get("/activities/#{uuid}")
 329
 330       assert json_response(conn1, :ok)
 331       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 332
 333       conn2 =
 334         conn
 335         |> put_req_header("accept", "application/activity+json")
 336         |> get("/activities/#{uuid}")
 337
 338       assert json_response(conn1, :ok) == json_response(conn2, :ok)
 339       assert Enum.any?(conn2.resp_headers, &(&1 == {"x-cache", "HIT from Pleroma"}))
 340     end
 341
 342     test "cached purged after activity deletion", %{conn: conn} do
 343       user = insert(:user)
 344       {:ok, activity} = CommonAPI.post(user, %{"status" => "cofe"})
 345
 346       uuid = String.split(activity.data["id"], "/") |> List.last()
 347
 348       conn1 =
 349         conn
 350         |> put_req_header("accept", "application/activity+json")
 351         |> get("/activities/#{uuid}")
 352
 353       assert json_response(conn1, :ok)
 354       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 355
 356       Activity.delete_all_by_object_ap_id(activity.object.data["id"])
 357
 358       conn2 =
 359         conn
 360         |> put_req_header("accept", "application/activity+json")
 361         |> get("/activities/#{uuid}")
 362
 363       assert "Not found" == json_response(conn2, :not_found)
 364     end
 365
 366     test "it requires authentication if instance is NOT federating", %{
 367       conn: conn
 368     } do
 369       user = insert(:user)
 370       activity = insert(:note_activity)
 371       uuid = String.split(activity.data["id"], "/") |> List.last()
 372
 373       conn = put_req_header(conn, "accept", "application/activity+json")
 374
 375       ensure_federating_or_authenticated(conn, "/activities/#{uuid}", user)
 376     end
 377   end
 378
 379   describe "/inbox" do
 380     test "it inserts an incoming activity into the database", %{conn: conn} do
 381       data = File.read!("test/fixtures/mastodon-post-activity.json") |> Poison.decode!()
 382
 383       conn =
 384         conn
 385         |> assign(:valid_signature, true)
 386         |> put_req_header("content-type", "application/activity+json")
 387         |> post("/inbox", data)
 388
 389       assert "ok" == json_response(conn, 200)
 390
 391       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 392       assert Activity.get_by_ap_id(data["id"])
 393     end
 394
 395     test "it clears `unreachable` federation status of the sender", %{conn: conn} do
 396       data = File.read!("test/fixtures/mastodon-post-activity.json") |> Poison.decode!()
 397
 398       sender_url = data["actor"]
 399       Instances.set_consistently_unreachable(sender_url)
 400       refute Instances.reachable?(sender_url)
 401
 402       conn =
 403         conn
 404         |> assign(:valid_signature, true)
 405         |> put_req_header("content-type", "application/activity+json")
 406         |> post("/inbox", data)
 407
 408       assert "ok" == json_response(conn, 200)
 409       assert Instances.reachable?(sender_url)
 410     end
 411
 412     test "accept follow activity", %{conn: conn} do
 413       Pleroma.Config.put([:instance, :federating], true)
 414       relay = Relay.get_actor()
 415
 416       assert {:ok, %Activity{} = activity} = Relay.follow("https://relay.mastodon.host/actor")
 417
 418       followed_relay = Pleroma.User.get_by_ap_id("https://relay.mastodon.host/actor")
 419       relay = refresh_record(relay)
 420
 421       accept =
 422         File.read!("test/fixtures/relay/accept-follow.json")
 423         |> String.replace("{{ap_id}}", relay.ap_id)
 424         |> String.replace("{{activity_id}}", activity.data["id"])
 425
 426       assert "ok" ==
 427                conn
 428                |> assign(:valid_signature, true)
 429                |> put_req_header("content-type", "application/activity+json")
 430                |> post("/inbox", accept)
 431                |> json_response(200)
 432
 433       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 434
 435       assert Pleroma.FollowingRelationship.following?(
 436                relay,
 437                followed_relay
 438              )
 439
 440       Mix.shell(Mix.Shell.Process)
 441
 442       on_exit(fn ->
 443         Mix.shell(Mix.Shell.IO)
 444       end)
 445
 446       :ok = Mix.Tasks.Pleroma.Relay.run(["list"])
 447       assert_receive {:mix_shell, :info, ["relay.mastodon.host"]}
 448     end
 449
 450     test "without valid signature, " <>
 451            "it only accepts Create activities and requires enabled federation",
 452          %{conn: conn} do
 453       data = File.read!("test/fixtures/mastodon-post-activity.json") |> Poison.decode!()
 454       non_create_data = File.read!("test/fixtures/mastodon-announce.json") |> Poison.decode!()
 455
 456       conn = put_req_header(conn, "content-type", "application/activity+json")
 457
 458       Config.put([:instance, :federating], false)
 459
 460       conn
 461       |> post("/inbox", data)
 462       |> json_response(403)
 463
 464       conn
 465       |> post("/inbox", non_create_data)
 466       |> json_response(403)
 467
 468       Config.put([:instance, :federating], true)
 469
 470       ret_conn = post(conn, "/inbox", data)
 471       assert "ok" == json_response(ret_conn, 200)
 472
 473       conn
 474       |> post("/inbox", non_create_data)
 475       |> json_response(400)
 476     end
 477   end
 478
 479   describe "/users/:nickname/inbox" do
 480     setup do
 481       data =
 482         File.read!("test/fixtures/mastodon-post-activity.json")
 483         |> Poison.decode!()
 484
 485       [data: data]
 486     end
 487
 488     test "it inserts an incoming activity into the database", %{conn: conn, data: data} do
 489       user = insert(:user)
 490       data = Map.put(data, "bcc", [user.ap_id])
 491
 492       conn =
 493         conn
 494         |> assign(:valid_signature, true)
 495         |> put_req_header("content-type", "application/activity+json")
 496         |> post("/users/#{user.nickname}/inbox", data)
 497
 498       assert "ok" == json_response(conn, 200)
 499       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 500       assert Activity.get_by_ap_id(data["id"])
 501     end
 502
 503     test "it accepts messages with to as string instead of array", %{conn: conn, data: data} do
 504       user = insert(:user)
 505
 506       data =
 507         Map.put(data, "to", user.ap_id)
 508         |> Map.delete("cc")
 509
 510       conn =
 511         conn
 512         |> assign(:valid_signature, true)
 513         |> put_req_header("content-type", "application/activity+json")
 514         |> post("/users/#{user.nickname}/inbox", data)
 515
 516       assert "ok" == json_response(conn, 200)
 517       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 518       assert Activity.get_by_ap_id(data["id"])
 519     end
 520
 521     test "it accepts messages with cc as string instead of array", %{conn: conn, data: data} do
 522       user = insert(:user)
 523
 524       data =
 525         Map.put(data, "cc", user.ap_id)
 526         |> Map.delete("to")
 527
 528       conn =
 529         conn
 530         |> assign(:valid_signature, true)
 531         |> put_req_header("content-type", "application/activity+json")
 532         |> post("/users/#{user.nickname}/inbox", data)
 533
 534       assert "ok" == json_response(conn, 200)
 535       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 536       %Activity{} = activity = Activity.get_by_ap_id(data["id"])
 537       assert user.ap_id in activity.recipients
 538     end
 539
 540     test "it accepts messages with bcc as string instead of array", %{conn: conn, data: data} do
 541       user = insert(:user)
 542
 543       data =
 544         Map.put(data, "bcc", user.ap_id)
 545         |> Map.delete("to")
 546         |> Map.delete("cc")
 547
 548       conn =
 549         conn
 550         |> assign(:valid_signature, true)
 551         |> put_req_header("content-type", "application/activity+json")
 552         |> post("/users/#{user.nickname}/inbox", data)
 553
 554       assert "ok" == json_response(conn, 200)
 555       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 556       assert Activity.get_by_ap_id(data["id"])
 557     end
 558
 559     test "it accepts announces with to as string instead of array", %{conn: conn} do
 560       user = insert(:user)
 561
 562       data = %{
 563         "@context" => "https://www.w3.org/ns/activitystreams",
 564         "actor" => "http://mastodon.example.org/users/admin",
 565         "id" => "http://mastodon.example.org/users/admin/statuses/19512778738411822/activity",
 566         "object" => "https://mastodon.social/users/emelie/statuses/101849165031453009",
 567         "to" => "https://www.w3.org/ns/activitystreams#Public",
 568         "cc" => [user.ap_id],
 569         "type" => "Announce"
 570       }
 571
 572       conn =
 573         conn
 574         |> assign(:valid_signature, true)
 575         |> put_req_header("content-type", "application/activity+json")
 576         |> post("/users/#{user.nickname}/inbox", data)
 577
 578       assert "ok" == json_response(conn, 200)
 579       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 580       %Activity{} = activity = Activity.get_by_ap_id(data["id"])
 581       assert "https://www.w3.org/ns/activitystreams#Public" in activity.recipients
 582     end
 583
 584     test "it accepts messages from actors that are followed by the user", %{
 585       conn: conn,
 586       data: data
 587     } do
 588       recipient = insert(:user)
 589       actor = insert(:user, %{ap_id: "http://mastodon.example.org/users/actor"})
 590
 591       {:ok, recipient} = User.follow(recipient, actor)
 592
 593       object =
 594         data["object"]
 595         |> Map.put("attributedTo", actor.ap_id)
 596
 597       data =
 598         data
 599         |> Map.put("actor", actor.ap_id)
 600         |> Map.put("object", object)
 601
 602       conn =
 603         conn
 604         |> assign(:valid_signature, true)
 605         |> put_req_header("content-type", "application/activity+json")
 606         |> post("/users/#{recipient.nickname}/inbox", data)
 607
 608       assert "ok" == json_response(conn, 200)
 609       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 610       assert Activity.get_by_ap_id(data["id"])
 611     end
 612
 613     test "it rejects reads from other users", %{conn: conn} do
 614       user = insert(:user)
 615       other_user = insert(:user)
 616
 617       conn =
 618         conn
 619         |> assign(:user, other_user)
 620         |> put_req_header("accept", "application/activity+json")
 621         |> get("/users/#{user.nickname}/inbox")
 622
 623       assert json_response(conn, 403)
 624     end
 625
 626     test "it returns a note activity in a collection", %{conn: conn} do
 627       note_activity = insert(:direct_note_activity)
 628       note_object = Object.normalize(note_activity)
 629       user = User.get_cached_by_ap_id(hd(note_activity.data["to"]))
 630
 631       conn =
 632         conn
 633         |> assign(:user, user)
 634         |> put_req_header("accept", "application/activity+json")
 635         |> get("/users/#{user.nickname}/inbox?page=true")
 636
 637       assert response(conn, 200) =~ note_object.data["content"]
 638     end
 639
 640     test "it clears `unreachable` federation status of the sender", %{conn: conn, data: data} do
 641       user = insert(:user)
 642       data = Map.put(data, "bcc", [user.ap_id])
 643
 644       sender_host = URI.parse(data["actor"]).host
 645       Instances.set_consistently_unreachable(sender_host)
 646       refute Instances.reachable?(sender_host)
 647
 648       conn =
 649         conn
 650         |> assign(:valid_signature, true)
 651         |> put_req_header("content-type", "application/activity+json")
 652         |> post("/users/#{user.nickname}/inbox", data)
 653
 654       assert "ok" == json_response(conn, 200)
 655       assert Instances.reachable?(sender_host)
 656     end
 657
 658     test "it removes all follower collections but actor's", %{conn: conn} do
 659       [actor, recipient] = insert_pair(:user)
 660
 661       data =
 662         File.read!("test/fixtures/activitypub-client-post-activity.json")
 663         |> Poison.decode!()
 664
 665       object = Map.put(data["object"], "attributedTo", actor.ap_id)
 666
 667       data =
 668         data
 669         |> Map.put("id", Utils.generate_object_id())
 670         |> Map.put("actor", actor.ap_id)
 671         |> Map.put("object", object)
 672         |> Map.put("cc", [
 673           recipient.follower_address,
 674           actor.follower_address
 675         ])
 676         |> Map.put("to", [
 677           recipient.ap_id,
 678           recipient.follower_address,
 679           "https://www.w3.org/ns/activitystreams#Public"
 680         ])
 681
 682       conn
 683       |> assign(:valid_signature, true)
 684       |> put_req_header("content-type", "application/activity+json")
 685       |> post("/users/#{recipient.nickname}/inbox", data)
 686       |> json_response(200)
 687
 688       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 689
 690       activity = Activity.get_by_ap_id(data["id"])
 691
 692       assert activity.id
 693       assert actor.follower_address in activity.recipients
 694       assert actor.follower_address in activity.data["cc"]
 695
 696       refute recipient.follower_address in activity.recipients
 697       refute recipient.follower_address in activity.data["cc"]
 698       refute recipient.follower_address in activity.data["to"]
 699     end
 700
 701     test "it requires authentication", %{conn: conn} do
 702       user = insert(:user)
 703       conn = put_req_header(conn, "accept", "application/activity+json")
 704
 705       ret_conn = get(conn, "/users/#{user.nickname}/inbox")
 706       assert json_response(ret_conn, 403)
 707
 708       ret_conn =
 709         conn
 710         |> assign(:user, user)
 711         |> get("/users/#{user.nickname}/inbox")
 712
 713       assert json_response(ret_conn, 200)
 714     end
 715   end
 716
 717   describe "GET /users/:nickname/outbox" do
 718     test "it returns 200 even if there're no activities", %{conn: conn} do
 719       user = insert(:user)
 720
 721       conn =
 722         conn
 723         |> assign(:user, user)
 724         |> put_req_header("accept", "application/activity+json")
 725         |> get("/users/#{user.nickname}/outbox")
 726
 727       result = json_response(conn, 200)
 728       assert user.ap_id <> "/outbox" == result["id"]
 729     end
 730
 731     test "it returns a note activity in a collection", %{conn: conn} do
 732       note_activity = insert(:note_activity)
 733       note_object = Object.normalize(note_activity)
 734       user = User.get_cached_by_ap_id(note_activity.data["actor"])
 735
 736       conn =
 737         conn
 738         |> assign(:user, user)
 739         |> put_req_header("accept", "application/activity+json")
 740         |> get("/users/#{user.nickname}/outbox?page=true")
 741
 742       assert response(conn, 200) =~ note_object.data["content"]
 743     end
 744
 745     test "it returns an announce activity in a collection", %{conn: conn} do
 746       announce_activity = insert(:announce_activity)
 747       user = User.get_cached_by_ap_id(announce_activity.data["actor"])
 748
 749       conn =
 750         conn
 751         |> assign(:user, user)
 752         |> put_req_header("accept", "application/activity+json")
 753         |> get("/users/#{user.nickname}/outbox?page=true")
 754
 755       assert response(conn, 200) =~ announce_activity.data["object"]
 756     end
 757
 758     test "it requires authentication if instance is NOT federating", %{
 759       conn: conn
 760     } do
 761       user = insert(:user)
 762       conn = put_req_header(conn, "accept", "application/activity+json")
 763
 764       ensure_federating_or_authenticated(conn, "/users/#{user.nickname}/outbox", user)
 765     end
 766   end
 767
 768   describe "POST /users/:nickname/outbox (C2S)" do
 769     setup do
 770       [
 771         activity: %{
 772           "@context" => "https://www.w3.org/ns/activitystreams",
 773           "type" => "Create",
 774           "object" => %{"type" => "Note", "content" => "AP C2S test"},
 775           "to" => "https://www.w3.org/ns/activitystreams#Public",
 776           "cc" => []
 777         }
 778       ]
 779     end
 780
 781     test "it rejects posts from other users / unauthenticated users", %{
 782       conn: conn,
 783       activity: activity
 784     } do
 785       user = insert(:user)
 786       other_user = insert(:user)
 787       conn = put_req_header(conn, "content-type", "application/activity+json")
 788
 789       conn
 790       |> post("/users/#{user.nickname}/outbox", activity)
 791       |> json_response(403)
 792
 793       conn
 794       |> assign(:user, other_user)
 795       |> post("/users/#{user.nickname}/outbox", activity)
 796       |> json_response(403)
 797     end
 798
 799     test "it inserts an incoming create activity into the database", %{
 800       conn: conn,
 801       activity: activity
 802     } do
 803       user = insert(:user)
 804
 805       result =
 806         conn
 807         |> assign(:user, user)
 808         |> put_req_header("content-type", "application/activity+json")
 809         |> post("/users/#{user.nickname}/outbox", activity)
 810         |> json_response(201)
 811
 812       assert Activity.get_by_ap_id(result["id"])
 813       assert result["object"]
 814       assert %Object{data: object} = Object.normalize(result["object"])
 815       assert object["content"] == activity["object"]["content"]
 816     end
 817
 818     test "it inserts an incoming sensitive activity into the database", %{
 819       conn: conn,
 820       activity: activity
 821     } do
 822       user = insert(:user)
 823       conn = assign(conn, :user, user)
 824       object = Map.put(activity["object"], "sensitive", true)
 825       activity = Map.put(activity, "object", object)
 826
 827       response =
 828         conn
 829         |> put_req_header("content-type", "application/activity+json")
 830         |> post("/users/#{user.nickname}/outbox", activity)
 831         |> json_response(201)
 832
 833       assert Activity.get_by_ap_id(response["id"])
 834       assert response["object"]
 835       assert %Object{data: response_object} = Object.normalize(response["object"])
 836       assert response_object["sensitive"] == true
 837       assert response_object["content"] == activity["object"]["content"]
 838
 839       representation =
 840         conn
 841         |> put_req_header("accept", "application/activity+json")
 842         |> get(response["id"])
 843         |> json_response(200)
 844
 845       assert representation["object"]["sensitive"] == true
 846     end
 847
 848     test "it rejects an incoming activity with bogus type", %{conn: conn, activity: activity} do
 849       user = insert(:user)
 850       activity = Map.put(activity, "type", "BadType")
 851
 852       conn =
 853         conn
 854         |> assign(:user, user)
 855         |> put_req_header("content-type", "application/activity+json")
 856         |> post("/users/#{user.nickname}/outbox", activity)
 857
 858       assert json_response(conn, 400)
 859     end
 860
 861     test "it erects a tombstone when receiving a delete activity", %{conn: conn} do
 862       note_activity = insert(:note_activity)
 863       note_object = Object.normalize(note_activity)
 864       user = User.get_cached_by_ap_id(note_activity.data["actor"])
 865
 866       data = %{
 867         type: "Delete",
 868         object: %{
 869           id: note_object.data["id"]
 870         }
 871       }
 872
 873       conn =
 874         conn
 875         |> assign(:user, user)
 876         |> put_req_header("content-type", "application/activity+json")
 877         |> post("/users/#{user.nickname}/outbox", data)
 878
 879       result = json_response(conn, 201)
 880       assert Activity.get_by_ap_id(result["id"])
 881
 882       assert object = Object.get_by_ap_id(note_object.data["id"])
 883       assert object.data["type"] == "Tombstone"
 884     end
 885
 886     test "it rejects delete activity of object from other actor", %{conn: conn} do
 887       note_activity = insert(:note_activity)
 888       note_object = Object.normalize(note_activity)
 889       user = insert(:user)
 890
 891       data = %{
 892         type: "Delete",
 893         object: %{
 894           id: note_object.data["id"]
 895         }
 896       }
 897
 898       conn =
 899         conn
 900         |> assign(:user, user)
 901         |> put_req_header("content-type", "application/activity+json")
 902         |> post("/users/#{user.nickname}/outbox", data)
 903
 904       assert json_response(conn, 400)
 905     end
 906
 907     test "it increases like count when receiving a like action", %{conn: conn} do
 908       note_activity = insert(:note_activity)
 909       note_object = Object.normalize(note_activity)
 910       user = User.get_cached_by_ap_id(note_activity.data["actor"])
 911
 912       data = %{
 913         type: "Like",
 914         object: %{
 915           id: note_object.data["id"]
 916         }
 917       }
 918
 919       conn =
 920         conn
 921         |> assign(:user, user)
 922         |> put_req_header("content-type", "application/activity+json")
 923         |> post("/users/#{user.nickname}/outbox", data)
 924
 925       result = json_response(conn, 201)
 926       assert Activity.get_by_ap_id(result["id"])
 927
 928       assert object = Object.get_by_ap_id(note_object.data["id"])
 929       assert object.data["like_count"] == 1
 930     end
 931   end
 932
 933   describe "/relay/followers" do
 934     test "it returns relay followers", %{conn: conn} do
 935       relay_actor = Relay.get_actor()
 936       user = insert(:user)
 937       User.follow(user, relay_actor)
 938
 939       result =
 940         conn
 941         |> get("/relay/followers")
 942         |> json_response(200)
 943
 944       assert result["first"]["orderedItems"] == [user.ap_id]
 945     end
 946
 947     test "on non-federating instance, it returns 404", %{conn: conn} do
 948       Config.put([:instance, :federating], false)
 949       user = insert(:user)
 950
 951       conn
 952       |> assign(:user, user)
 953       |> get("/relay/followers")
 954       |> json_response(404)
 955     end
 956   end
 957
 958   describe "/relay/following" do
 959     test "it returns relay following", %{conn: conn} do
 960       result =
 961         conn
 962         |> get("/relay/following")
 963         |> json_response(200)
 964
 965       assert result["first"]["orderedItems"] == []
 966     end
 967
 968     test "on non-federating instance, it returns 404", %{conn: conn} do
 969       Config.put([:instance, :federating], false)
 970       user = insert(:user)
 971
 972       conn
 973       |> assign(:user, user)
 974       |> get("/relay/following")
 975       |> json_response(404)
 976     end
 977   end
 978
 979   describe "/users/:nickname/followers" do
 980     test "it returns the followers in a collection", %{conn: conn} do
 981       user = insert(:user)
 982       user_two = insert(:user)
 983       User.follow(user, user_two)
 984
 985       result =
 986         conn
 987         |> assign(:user, user_two)
 988         |> get("/users/#{user_two.nickname}/followers")
 989         |> json_response(200)
 990
 991       assert result["first"]["orderedItems"] == [user.ap_id]
 992     end
 993
 994     test "it returns a uri if the user has 'hide_followers' set", %{conn: conn} do
 995       user = insert(:user)
 996       user_two = insert(:user, hide_followers: true)
 997       User.follow(user, user_two)
 998
 999       result =
1000         conn
1001         |> assign(:user, user)
1002         |> get("/users/#{user_two.nickname}/followers")
1003         |> json_response(200)
1004
1005       assert is_binary(result["first"])
1006     end
1007
1008     test "it returns a 403 error on pages, if the user has 'hide_followers' set and the request is from another user",
1009          %{conn: conn} do
1010       user = insert(:user)
1011       other_user = insert(:user, hide_followers: true)
1012
1013       result =
1014         conn
1015         |> assign(:user, user)
1016         |> get("/users/#{other_user.nickname}/followers?page=1")
1017
1018       assert result.status == 403
1019       assert result.resp_body == ""
1020     end
1021
1022     test "it renders the page, if the user has 'hide_followers' set and the request is authenticated with the same user",
1023          %{conn: conn} do
1024       user = insert(:user, hide_followers: true)
1025       other_user = insert(:user)
1026       {:ok, _other_user, user, _activity} = CommonAPI.follow(other_user, user)
1027
1028       result =
1029         conn
1030         |> assign(:user, user)
1031         |> get("/users/#{user.nickname}/followers?page=1")
1032         |> json_response(200)
1033
1034       assert result["totalItems"] == 1
1035       assert result["orderedItems"] == [other_user.ap_id]
1036     end
1037
1038     test "it works for more than 10 users", %{conn: conn} do
1039       user = insert(:user)
1040
1041       Enum.each(1..15, fn _ ->
1042         other_user = insert(:user)
1043         User.follow(other_user, user)
1044       end)
1045
1046       result =
1047         conn
1048         |> assign(:user, user)
1049         |> get("/users/#{user.nickname}/followers")
1050         |> json_response(200)
1051
1052       assert length(result["first"]["orderedItems"]) == 10
1053       assert result["first"]["totalItems"] == 15
1054       assert result["totalItems"] == 15
1055
1056       result =
1057         conn
1058         |> assign(:user, user)
1059         |> get("/users/#{user.nickname}/followers?page=2")
1060         |> json_response(200)
1061
1062       assert length(result["orderedItems"]) == 5
1063       assert result["totalItems"] == 15
1064     end
1065
1066     test "does not require authentication", %{conn: conn} do
1067       user = insert(:user)
1068
1069       conn
1070       |> get("/users/#{user.nickname}/followers")
1071       |> json_response(200)
1072     end
1073   end
1074
1075   describe "/users/:nickname/following" do
1076     test "it returns the following in a collection", %{conn: conn} do
1077       user = insert(:user)
1078       user_two = insert(:user)
1079       User.follow(user, user_two)
1080
1081       result =
1082         conn
1083         |> assign(:user, user)
1084         |> get("/users/#{user.nickname}/following")
1085         |> json_response(200)
1086
1087       assert result["first"]["orderedItems"] == [user_two.ap_id]
1088     end
1089
1090     test "it returns a uri if the user has 'hide_follows' set", %{conn: conn} do
1091       user = insert(:user)
1092       user_two = insert(:user, hide_follows: true)
1093       User.follow(user, user_two)
1094
1095       result =
1096         conn
1097         |> assign(:user, user)
1098         |> get("/users/#{user_two.nickname}/following")
1099         |> json_response(200)
1100
1101       assert is_binary(result["first"])
1102     end
1103
1104     test "it returns a 403 error on pages, if the user has 'hide_follows' set and the request is from another user",
1105          %{conn: conn} do
1106       user = insert(:user)
1107       user_two = insert(:user, hide_follows: true)
1108
1109       result =
1110         conn
1111         |> assign(:user, user)
1112         |> get("/users/#{user_two.nickname}/following?page=1")
1113
1114       assert result.status == 403
1115       assert result.resp_body == ""
1116     end
1117
1118     test "it renders the page, if the user has 'hide_follows' set and the request is authenticated with the same user",
1119          %{conn: conn} do
1120       user = insert(:user, hide_follows: true)
1121       other_user = insert(:user)
1122       {:ok, user, _other_user, _activity} = CommonAPI.follow(user, other_user)
1123
1124       result =
1125         conn
1126         |> assign(:user, user)
1127         |> get("/users/#{user.nickname}/following?page=1")
1128         |> json_response(200)
1129
1130       assert result["totalItems"] == 1
1131       assert result["orderedItems"] == [other_user.ap_id]
1132     end
1133
1134     test "it works for more than 10 users", %{conn: conn} do
1135       user = insert(:user)
1136
1137       Enum.each(1..15, fn _ ->
1138         user = User.get_cached_by_id(user.id)
1139         other_user = insert(:user)
1140         User.follow(user, other_user)
1141       end)
1142
1143       result =
1144         conn
1145         |> assign(:user, user)
1146         |> get("/users/#{user.nickname}/following")
1147         |> json_response(200)
1148
1149       assert length(result["first"]["orderedItems"]) == 10
1150       assert result["first"]["totalItems"] == 15
1151       assert result["totalItems"] == 15
1152
1153       result =
1154         conn
1155         |> assign(:user, user)
1156         |> get("/users/#{user.nickname}/following?page=2")
1157         |> json_response(200)
1158
1159       assert length(result["orderedItems"]) == 5
1160       assert result["totalItems"] == 15
1161     end
1162
1163     test "does not require authentication", %{conn: conn} do
1164       user = insert(:user)
1165
1166       conn
1167       |> get("/users/#{user.nickname}/following")
1168       |> json_response(200)
1169     end
1170   end
1171
1172   describe "delivery tracking" do
1173     test "it tracks a signed object fetch", %{conn: conn} do
1174       user = insert(:user, local: false)
1175       activity = insert(:note_activity)
1176       object = Object.normalize(activity)
1177
1178       object_path = String.trim_leading(object.data["id"], Pleroma.Web.Endpoint.url())
1179
1180       conn
1181       |> put_req_header("accept", "application/activity+json")
1182       |> assign(:user, user)
1183       |> get(object_path)
1184       |> json_response(200)
1185
1186       assert Delivery.get(object.id, user.id)
1187     end
1188
1189     test "it tracks a signed activity fetch", %{conn: conn} do
1190       user = insert(:user, local: false)
1191       activity = insert(:note_activity)
1192       object = Object.normalize(activity)
1193
1194       activity_path = String.trim_leading(activity.data["id"], Pleroma.Web.Endpoint.url())
1195
1196       conn
1197       |> put_req_header("accept", "application/activity+json")
1198       |> assign(:user, user)
1199       |> get(activity_path)
1200       |> json_response(200)
1201
1202       assert Delivery.get(object.id, user.id)
1203     end
1204
1205     test "it tracks a signed object fetch when the json is cached", %{conn: conn} do
1206       user = insert(:user, local: false)
1207       other_user = insert(:user, local: false)
1208       activity = insert(:note_activity)
1209       object = Object.normalize(activity)
1210
1211       object_path = String.trim_leading(object.data["id"], Pleroma.Web.Endpoint.url())
1212
1213       conn
1214       |> put_req_header("accept", "application/activity+json")
1215       |> assign(:user, user)
1216       |> get(object_path)
1217       |> json_response(200)
1218
1219       build_conn()
1220       |> put_req_header("accept", "application/activity+json")
1221       |> assign(:user, other_user)
1222       |> get(object_path)
1223       |> json_response(200)
1224
1225       assert Delivery.get(object.id, user.id)
1226       assert Delivery.get(object.id, other_user.id)
1227     end
1228
1229     test "it tracks a signed activity fetch when the json is cached", %{conn: conn} do
1230       user = insert(:user, local: false)
1231       other_user = insert(:user, local: false)
1232       activity = insert(:note_activity)
1233       object = Object.normalize(activity)
1234
1235       activity_path = String.trim_leading(activity.data["id"], Pleroma.Web.Endpoint.url())
1236
1237       conn
1238       |> put_req_header("accept", "application/activity+json")
1239       |> assign(:user, user)
1240       |> get(activity_path)
1241       |> json_response(200)
1242
1243       build_conn()
1244       |> put_req_header("accept", "application/activity+json")
1245       |> assign(:user, other_user)
1246       |> get(activity_path)
1247       |> json_response(200)
1248
1249       assert Delivery.get(object.id, user.id)
1250       assert Delivery.get(object.id, other_user.id)
1251     end
1252   end
1253
1254   describe "Additional ActivityPub C2S endpoints" do
1255     test "GET /api/ap/whoami", %{conn: conn} do
1256       user = insert(:user)
1257
1258       conn =
1259         conn
1260         |> assign(:user, user)
1261         |> get("/api/ap/whoami")
1262
1263       user = User.get_cached_by_id(user.id)
1264
1265       assert UserView.render("user.json", %{user: user}) == json_response(conn, 200)
1266
1267       conn
1268       |> get("/api/ap/whoami")
1269       |> json_response(403)
1270     end
1271
1272     setup do: clear_config([:media_proxy])
1273     setup do: clear_config([Pleroma.Upload])
1274
1275     test "POST /api/ap/upload_media", %{conn: conn} do
1276       user = insert(:user)
1277
1278       desc = "Description of the image"
1279
1280       image = %Plug.Upload{
1281         content_type: "image/jpg",
1282         path: Path.absname("test/fixtures/image.jpg"),
1283         filename: "an_image.jpg"
1284       }
1285
1286       object =
1287         conn
1288         |> assign(:user, user)
1289         |> post("/api/ap/upload_media", %{"file" => image, "description" => desc})
1290         |> json_response(:created)
1291
1292       assert object["name"] == desc
1293       assert object["type"] == "Document"
1294       assert object["actor"] == user.ap_id
1295       assert [%{"href" => object_href, "mediaType" => object_mediatype}] = object["url"]
1296       assert is_binary(object_href)
1297       assert object_mediatype == "image/jpeg"
1298
1299       activity_request = %{
1300         "@context" => "https://www.w3.org/ns/activitystreams",
1301         "type" => "Create",
1302         "object" => %{
1303           "type" => "Note",
1304           "content" => "AP C2S test, attachment",
1305           "attachment" => [object]
1306         },
1307         "to" => "https://www.w3.org/ns/activitystreams#Public",
1308         "cc" => []
1309       }
1310
1311       activity_response =
1312         conn
1313         |> assign(:user, user)
1314         |> post("/users/#{user.nickname}/outbox", activity_request)
1315         |> json_response(:created)
1316
1317       assert activity_response["id"]
1318       assert activity_response["object"]
1319       assert activity_response["actor"] == user.ap_id
1320
1321       assert %Object{data: %{"attachment" => [attachment]}} =
1322                Object.normalize(activity_response["object"])
1323
1324       assert attachment["type"] == "Document"
1325       assert attachment["name"] == desc
1326
1327       assert [
1328                %{
1329                  "href" => ^object_href,
1330                  "type" => "Link",
1331                  "mediaType" => ^object_mediatype
1332                }
1333              ] = attachment["url"]
1334
1335       # Fails if unauthenticated
1336       conn
1337       |> post("/api/ap/upload_media", %{"file" => image, "description" => desc})
1338       |> json_response(403)
1339     end
1340   end
1341 end