git.squeep.com Git - akkoma/blob - test/web/mastodon_api/controllers/account_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.AccountControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   alias Pleroma.Config
   9   alias Pleroma.Repo
  10   alias Pleroma.User
  11   alias Pleroma.Web.ActivityPub.ActivityPub
  12   alias Pleroma.Web.ActivityPub.InternalFetchActor
  13   alias Pleroma.Web.CommonAPI
  14   alias Pleroma.Web.OAuth.Token
  15
  16   import Pleroma.Factory
  17
  18   describe "account fetching" do
  19     setup do: clear_config([:instance, :limit_to_local_content])
  20
  21     test "works by id" do
  22       %User{id: user_id} = insert(:user)
  23
  24       assert %{"id" => ^user_id} =
  25                build_conn()
  26                |> get("/api/v1/accounts/#{user_id}")
  27                |> json_response_and_validate_schema(200)
  28
  29       assert %{"error" => "Can't find user"} =
  30                build_conn()
  31                |> get("/api/v1/accounts/-1")
  32                |> json_response_and_validate_schema(404)
  33     end
  34
  35     test "works by nickname" do
  36       user = insert(:user)
  37
  38       assert %{"id" => user_id} =
  39                build_conn()
  40                |> get("/api/v1/accounts/#{user.nickname}")
  41                |> json_response_and_validate_schema(200)
  42     end
  43
  44     test "works by nickname for remote users" do
  45       Config.put([:instance, :limit_to_local_content], false)
  46
  47       user = insert(:user, nickname: "user@example.com", local: false)
  48
  49       assert %{"id" => user_id} =
  50                build_conn()
  51                |> get("/api/v1/accounts/#{user.nickname}")
  52                |> json_response_and_validate_schema(200)
  53     end
  54
  55     test "respects limit_to_local_content == :all for remote user nicknames" do
  56       Config.put([:instance, :limit_to_local_content], :all)
  57
  58       user = insert(:user, nickname: "user@example.com", local: false)
  59
  60       assert build_conn()
  61              |> get("/api/v1/accounts/#{user.nickname}")
  62              |> json_response_and_validate_schema(404)
  63     end
  64
  65     test "respects limit_to_local_content == :unauthenticated for remote user nicknames" do
  66       Config.put([:instance, :limit_to_local_content], :unauthenticated)
  67
  68       user = insert(:user, nickname: "user@example.com", local: false)
  69       reading_user = insert(:user)
  70
  71       conn =
  72         build_conn()
  73         |> get("/api/v1/accounts/#{user.nickname}")
  74
  75       assert json_response_and_validate_schema(conn, 404)
  76
  77       conn =
  78         build_conn()
  79         |> assign(:user, reading_user)
  80         |> assign(:token, insert(:oauth_token, user: reading_user, scopes: ["read:accounts"]))
  81         |> get("/api/v1/accounts/#{user.nickname}")
  82
  83       assert %{"id" => id} = json_response_and_validate_schema(conn, 200)
  84       assert id == user.id
  85     end
  86
  87     test "accounts fetches correct account for nicknames beginning with numbers", %{conn: conn} do
  88       # Need to set an old-style integer ID to reproduce the problem
  89       # (these are no longer assigned to new accounts but were preserved
  90       # for existing accounts during the migration to flakeIDs)
  91       user_one = insert(:user, %{id: 1212})
  92       user_two = insert(:user, %{nickname: "#{user_one.id}garbage"})
  93
  94       acc_one =
  95         conn
  96         |> get("/api/v1/accounts/#{user_one.id}")
  97         |> json_response_and_validate_schema(:ok)
  98
  99       acc_two =
 100         conn
 101         |> get("/api/v1/accounts/#{user_two.nickname}")
 102         |> json_response_and_validate_schema(:ok)
 103
 104       acc_three =
 105         conn
 106         |> get("/api/v1/accounts/#{user_two.id}")
 107         |> json_response_and_validate_schema(:ok)
 108
 109       refute acc_one == acc_two
 110       assert acc_two == acc_three
 111     end
 112
 113     test "returns 404 when user is invisible", %{conn: conn} do
 114       user = insert(:user, %{invisible: true})
 115
 116       assert %{"error" => "Can't find user"} =
 117                conn
 118                |> get("/api/v1/accounts/#{user.nickname}")
 119                |> json_response_and_validate_schema(404)
 120     end
 121
 122     test "returns 404 for internal.fetch actor", %{conn: conn} do
 123       %User{nickname: "internal.fetch"} = InternalFetchActor.get_actor()
 124
 125       assert %{"error" => "Can't find user"} =
 126                conn
 127                |> get("/api/v1/accounts/internal.fetch")
 128                |> json_response_and_validate_schema(404)
 129     end
 130   end
 131
 132   defp local_and_remote_users do
 133     local = insert(:user)
 134     remote = insert(:user, local: false)
 135     {:ok, local: local, remote: remote}
 136   end
 137
 138   describe "user fetching with restrict unauthenticated profiles for local and remote" do
 139     setup do: local_and_remote_users()
 140
 141     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 142
 143     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 144
 145     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 146       assert %{"error" => "Can't find user"} ==
 147                conn
 148                |> get("/api/v1/accounts/#{local.id}")
 149                |> json_response_and_validate_schema(:not_found)
 150
 151       assert %{"error" => "Can't find user"} ==
 152                conn
 153                |> get("/api/v1/accounts/#{remote.id}")
 154                |> json_response_and_validate_schema(:not_found)
 155     end
 156
 157     test "if user is authenticated", %{local: local, remote: remote} do
 158       %{conn: conn} = oauth_access(["read"])
 159
 160       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 161       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 162
 163       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 164       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 165     end
 166   end
 167
 168   describe "user fetching with restrict unauthenticated profiles for local" do
 169     setup do: local_and_remote_users()
 170
 171     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 172
 173     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 174       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 175
 176       assert json_response_and_validate_schema(res_conn, :not_found) == %{
 177                "error" => "Can't find user"
 178              }
 179
 180       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 181       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 182     end
 183
 184     test "if user is authenticated", %{local: local, remote: remote} do
 185       %{conn: conn} = oauth_access(["read"])
 186
 187       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 188       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 189
 190       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 191       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 192     end
 193   end
 194
 195   describe "user fetching with restrict unauthenticated profiles for remote" do
 196     setup do: local_and_remote_users()
 197
 198     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 199
 200     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 201       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 202       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 203
 204       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 205
 206       assert json_response_and_validate_schema(res_conn, :not_found) == %{
 207                "error" => "Can't find user"
 208              }
 209     end
 210
 211     test "if user is authenticated", %{local: local, remote: remote} do
 212       %{conn: conn} = oauth_access(["read"])
 213
 214       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 215       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 216
 217       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 218       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 219     end
 220   end
 221
 222   describe "user timelines" do
 223     setup do: oauth_access(["read:statuses"])
 224
 225     test "works with announces that are just addressed to public", %{conn: conn} do
 226       user = insert(:user, ap_id: "https://honktest/u/test", local: false)
 227       other_user = insert(:user)
 228
 229       {:ok, post} = CommonAPI.post(other_user, %{"status" => "bonkeronk"})
 230
 231       {:ok, announce, _} =
 232         %{
 233           "@context" => "https://www.w3.org/ns/activitystreams",
 234           "actor" => "https://honktest/u/test",
 235           "id" => "https://honktest/u/test/bonk/1793M7B9MQ48847vdx",
 236           "object" => post.data["object"],
 237           "published" => "2019-06-25T19:33:58Z",
 238           "to" => ["https://www.w3.org/ns/activitystreams#Public"],
 239           "type" => "Announce"
 240         }
 241         |> ActivityPub.persist(local: false)
 242
 243       assert resp =
 244                conn
 245                |> get("/api/v1/accounts/#{user.id}/statuses")
 246                |> json_response_and_validate_schema(200)
 247
 248       assert [%{"id" => id}] = resp
 249       assert id == announce.id
 250     end
 251
 252     test "respects blocks", %{user: user_one, conn: conn} do
 253       user_two = insert(:user)
 254       user_three = insert(:user)
 255
 256       User.block(user_one, user_two)
 257
 258       {:ok, activity} = CommonAPI.post(user_two, %{"status" => "User one sux0rz"})
 259       {:ok, repeat, _} = CommonAPI.repeat(activity.id, user_three)
 260
 261       assert resp =
 262                conn
 263                |> get("/api/v1/accounts/#{user_two.id}/statuses")
 264                |> json_response_and_validate_schema(200)
 265
 266       assert [%{"id" => id}] = resp
 267       assert id == activity.id
 268
 269       # Even a blocked user will deliver the full user timeline, there would be
 270       #   no point in looking at a blocked users timeline otherwise
 271       assert resp =
 272                conn
 273                |> get("/api/v1/accounts/#{user_two.id}/statuses")
 274                |> json_response_and_validate_schema(200)
 275
 276       assert [%{"id" => id}] = resp
 277       assert id == activity.id
 278
 279       # Third user's timeline includes the repeat when viewed by unauthenticated user
 280       resp =
 281         build_conn()
 282         |> get("/api/v1/accounts/#{user_three.id}/statuses")
 283         |> json_response_and_validate_schema(200)
 284
 285       assert [%{"id" => id}] = resp
 286       assert id == repeat.id
 287
 288       # When viewing a third user's timeline, the blocked users' statuses will NOT be shown
 289       resp = get(conn, "/api/v1/accounts/#{user_three.id}/statuses")
 290
 291       assert [] == json_response_and_validate_schema(resp, 200)
 292     end
 293
 294     test "gets users statuses", %{conn: conn} do
 295       user_one = insert(:user)
 296       user_two = insert(:user)
 297       user_three = insert(:user)
 298
 299       {:ok, _user_three} = User.follow(user_three, user_one)
 300
 301       {:ok, activity} = CommonAPI.post(user_one, %{"status" => "HI!!!"})
 302
 303       {:ok, direct_activity} =
 304         CommonAPI.post(user_one, %{
 305           "status" => "Hi, @#{user_two.nickname}.",
 306           "visibility" => "direct"
 307         })
 308
 309       {:ok, private_activity} =
 310         CommonAPI.post(user_one, %{"status" => "private", "visibility" => "private"})
 311
 312       # TODO!!!
 313       resp =
 314         conn
 315         |> get("/api/v1/accounts/#{user_one.id}/statuses")
 316         |> json_response_and_validate_schema(200)
 317
 318       assert [%{"id" => id}] = resp
 319       assert id == to_string(activity.id)
 320
 321       resp =
 322         conn
 323         |> assign(:user, user_two)
 324         |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
 325         |> get("/api/v1/accounts/#{user_one.id}/statuses")
 326         |> json_response_and_validate_schema(200)
 327
 328       assert [%{"id" => id_one}, %{"id" => id_two}] = resp
 329       assert id_one == to_string(direct_activity.id)
 330       assert id_two == to_string(activity.id)
 331
 332       resp =
 333         conn
 334         |> assign(:user, user_three)
 335         |> assign(:token, insert(:oauth_token, user: user_three, scopes: ["read:statuses"]))
 336         |> get("/api/v1/accounts/#{user_one.id}/statuses")
 337         |> json_response_and_validate_schema(200)
 338
 339       assert [%{"id" => id_one}, %{"id" => id_two}] = resp
 340       assert id_one == to_string(private_activity.id)
 341       assert id_two == to_string(activity.id)
 342     end
 343
 344     test "unimplemented pinned statuses feature", %{conn: conn} do
 345       note = insert(:note_activity)
 346       user = User.get_cached_by_ap_id(note.data["actor"])
 347
 348       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?pinned=true")
 349
 350       assert json_response_and_validate_schema(conn, 200) == []
 351     end
 352
 353     test "gets an users media", %{conn: conn} do
 354       note = insert(:note_activity)
 355       user = User.get_cached_by_ap_id(note.data["actor"])
 356
 357       file = %Plug.Upload{
 358         content_type: "image/jpg",
 359         path: Path.absname("test/fixtures/image.jpg"),
 360         filename: "an_image.jpg"
 361       }
 362
 363       {:ok, %{id: media_id}} = ActivityPub.upload(file, actor: user.ap_id)
 364
 365       {:ok, %{id: image_post_id}} =
 366         CommonAPI.post(user, %{"status" => "cofe", "media_ids" => [media_id]})
 367
 368       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?only_media=true")
 369
 370       assert [%{"id" => ^image_post_id}] = json_response_and_validate_schema(conn, 200)
 371
 372       conn = get(build_conn(), "/api/v1/accounts/#{user.id}/statuses?only_media=1")
 373
 374       assert [%{"id" => ^image_post_id}] = json_response_and_validate_schema(conn, 200)
 375     end
 376
 377     test "gets a user's statuses without reblogs", %{user: user, conn: conn} do
 378       {:ok, %{id: post_id}} = CommonAPI.post(user, %{"status" => "HI!!!"})
 379       {:ok, _, _} = CommonAPI.repeat(post_id, user)
 380
 381       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_reblogs=true")
 382       assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)
 383
 384       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_reblogs=1")
 385       assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)
 386     end
 387
 388     test "filters user's statuses by a hashtag", %{user: user, conn: conn} do
 389       {:ok, %{id: post_id}} = CommonAPI.post(user, %{"status" => "#hashtag"})
 390       {:ok, _post} = CommonAPI.post(user, %{"status" => "hashtag"})
 391
 392       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?tagged=hashtag")
 393       assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)
 394     end
 395
 396     test "the user views their own timelines and excludes direct messages", %{
 397       user: user,
 398       conn: conn
 399     } do
 400       {:ok, %{id: public_activity_id}} =
 401         CommonAPI.post(user, %{"status" => ".", "visibility" => "public"})
 402
 403       {:ok, _direct_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "direct"})
 404
 405       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_visibilities[]=direct")
 406       assert [%{"id" => ^public_activity_id}] = json_response_and_validate_schema(conn, 200)
 407     end
 408   end
 409
 410   defp local_and_remote_activities(%{local: local, remote: remote}) do
 411     insert(:note_activity, user: local)
 412     insert(:note_activity, user: remote, local: false)
 413
 414     :ok
 415   end
 416
 417   describe "statuses with restrict unauthenticated profiles for local and remote" do
 418     setup do: local_and_remote_users()
 419     setup :local_and_remote_activities
 420
 421     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 422
 423     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 424
 425     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 426       assert %{"error" => "Can't find user"} ==
 427                conn
 428                |> get("/api/v1/accounts/#{local.id}/statuses")
 429                |> json_response_and_validate_schema(:not_found)
 430
 431       assert %{"error" => "Can't find user"} ==
 432                conn
 433                |> get("/api/v1/accounts/#{remote.id}/statuses")
 434                |> json_response_and_validate_schema(:not_found)
 435     end
 436
 437     test "if user is authenticated", %{local: local, remote: remote} do
 438       %{conn: conn} = oauth_access(["read"])
 439
 440       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 441       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 442
 443       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 444       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 445     end
 446   end
 447
 448   describe "statuses with restrict unauthenticated profiles for local" do
 449     setup do: local_and_remote_users()
 450     setup :local_and_remote_activities
 451
 452     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 453
 454     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 455       assert %{"error" => "Can't find user"} ==
 456                conn
 457                |> get("/api/v1/accounts/#{local.id}/statuses")
 458                |> json_response_and_validate_schema(:not_found)
 459
 460       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 461       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 462     end
 463
 464     test "if user is authenticated", %{local: local, remote: remote} do
 465       %{conn: conn} = oauth_access(["read"])
 466
 467       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 468       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 469
 470       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 471       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 472     end
 473   end
 474
 475   describe "statuses with restrict unauthenticated profiles for remote" do
 476     setup do: local_and_remote_users()
 477     setup :local_and_remote_activities
 478
 479     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 480
 481     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 482       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 483       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 484
 485       assert %{"error" => "Can't find user"} ==
 486                conn
 487                |> get("/api/v1/accounts/#{remote.id}/statuses")
 488                |> json_response_and_validate_schema(:not_found)
 489     end
 490
 491     test "if user is authenticated", %{local: local, remote: remote} do
 492       %{conn: conn} = oauth_access(["read"])
 493
 494       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 495       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 496
 497       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 498       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 499     end
 500   end
 501
 502   describe "followers" do
 503     setup do: oauth_access(["read:accounts"])
 504
 505     test "getting followers", %{user: user, conn: conn} do
 506       other_user = insert(:user)
 507       {:ok, %{id: user_id}} = User.follow(user, other_user)
 508
 509       conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")
 510
 511       assert [%{"id" => ^user_id}] = json_response_and_validate_schema(conn, 200)
 512     end
 513
 514     test "getting followers, hide_followers", %{user: user, conn: conn} do
 515       other_user = insert(:user, hide_followers: true)
 516       {:ok, _user} = User.follow(user, other_user)
 517
 518       conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")
 519
 520       assert [] == json_response_and_validate_schema(conn, 200)
 521     end
 522
 523     test "getting followers, hide_followers, same user requesting" do
 524       user = insert(:user)
 525       other_user = insert(:user, hide_followers: true)
 526       {:ok, _user} = User.follow(user, other_user)
 527
 528       conn =
 529         build_conn()
 530         |> assign(:user, other_user)
 531         |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
 532         |> get("/api/v1/accounts/#{other_user.id}/followers")
 533
 534       refute [] == json_response_and_validate_schema(conn, 200)
 535     end
 536
 537     test "getting followers, pagination", %{user: user, conn: conn} do
 538       {:ok, %User{id: follower1_id}} = :user |> insert() |> User.follow(user)
 539       {:ok, %User{id: follower2_id}} = :user |> insert() |> User.follow(user)
 540       {:ok, %User{id: follower3_id}} = :user |> insert() |> User.follow(user)
 541
 542       assert [%{"id" => ^follower3_id}, %{"id" => ^follower2_id}] =
 543                conn
 544                |> get("/api/v1/accounts/#{user.id}/followers?since_id=#{follower1_id}")
 545                |> json_response_and_validate_schema(200)
 546
 547       assert [%{"id" => ^follower2_id}, %{"id" => ^follower1_id}] =
 548                conn
 549                |> get("/api/v1/accounts/#{user.id}/followers?max_id=#{follower3_id}")
 550                |> json_response_and_validate_schema(200)
 551
 552       res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?limit=1&max_id=#{follower3_id}")
 553
 554       assert [%{"id" => ^follower2_id}] = json_response_and_validate_schema(res_conn, 200)
 555
 556       assert [link_header] = get_resp_header(res_conn, "link")
 557       assert link_header =~ ~r/min_id=#{follower2_id}/
 558       assert link_header =~ ~r/max_id=#{follower2_id}/
 559     end
 560   end
 561
 562   describe "following" do
 563     setup do: oauth_access(["read:accounts"])
 564
 565     test "getting following", %{user: user, conn: conn} do
 566       other_user = insert(:user)
 567       {:ok, user} = User.follow(user, other_user)
 568
 569       conn = get(conn, "/api/v1/accounts/#{user.id}/following")
 570
 571       assert [%{"id" => id}] = json_response_and_validate_schema(conn, 200)
 572       assert id == to_string(other_user.id)
 573     end
 574
 575     test "getting following, hide_follows, other user requesting" do
 576       user = insert(:user, hide_follows: true)
 577       other_user = insert(:user)
 578       {:ok, user} = User.follow(user, other_user)
 579
 580       conn =
 581         build_conn()
 582         |> assign(:user, other_user)
 583         |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
 584         |> get("/api/v1/accounts/#{user.id}/following")
 585
 586       assert [] == json_response_and_validate_schema(conn, 200)
 587     end
 588
 589     test "getting following, hide_follows, same user requesting" do
 590       user = insert(:user, hide_follows: true)
 591       other_user = insert(:user)
 592       {:ok, user} = User.follow(user, other_user)
 593
 594       conn =
 595         build_conn()
 596         |> assign(:user, user)
 597         |> assign(:token, insert(:oauth_token, user: user, scopes: ["read:accounts"]))
 598         |> get("/api/v1/accounts/#{user.id}/following")
 599
 600       refute [] == json_response_and_validate_schema(conn, 200)
 601     end
 602
 603     test "getting following, pagination", %{user: user, conn: conn} do
 604       following1 = insert(:user)
 605       following2 = insert(:user)
 606       following3 = insert(:user)
 607       {:ok, _} = User.follow(user, following1)
 608       {:ok, _} = User.follow(user, following2)
 609       {:ok, _} = User.follow(user, following3)
 610
 611       res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?since_id=#{following1.id}")
 612
 613       assert [%{"id" => id3}, %{"id" => id2}] = json_response_and_validate_schema(res_conn, 200)
 614       assert id3 == following3.id
 615       assert id2 == following2.id
 616
 617       res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?max_id=#{following3.id}")
 618
 619       assert [%{"id" => id2}, %{"id" => id1}] = json_response_and_validate_schema(res_conn, 200)
 620       assert id2 == following2.id
 621       assert id1 == following1.id
 622
 623       res_conn =
 624         get(conn, "/api/v1/accounts/#{user.id}/following?limit=1&max_id=#{following3.id}")
 625
 626       assert [%{"id" => id2}] = json_response_and_validate_schema(res_conn, 200)
 627       assert id2 == following2.id
 628
 629       assert [link_header] = get_resp_header(res_conn, "link")
 630       assert link_header =~ ~r/min_id=#{following2.id}/
 631       assert link_header =~ ~r/max_id=#{following2.id}/
 632     end
 633   end
 634
 635   describe "follow/unfollow" do
 636     setup do: oauth_access(["follow"])
 637
 638     test "following / unfollowing a user", %{conn: conn} do
 639       %{id: other_user_id, nickname: other_user_nickname} = insert(:user)
 640
 641       assert %{"id" => _id, "following" => true} =
 642                conn
 643                |> post("/api/v1/accounts/#{other_user_id}/follow")
 644                |> json_response_and_validate_schema(200)
 645
 646       assert %{"id" => _id, "following" => false} =
 647                conn
 648                |> post("/api/v1/accounts/#{other_user_id}/unfollow")
 649                |> json_response_and_validate_schema(200)
 650
 651       assert %{"id" => ^other_user_id} =
 652                conn
 653                |> put_req_header("content-type", "application/json")
 654                |> post("/api/v1/follows", %{"uri" => other_user_nickname})
 655                |> json_response_and_validate_schema(200)
 656     end
 657
 658     test "cancelling follow request", %{conn: conn} do
 659       %{id: other_user_id} = insert(:user, %{locked: true})
 660
 661       assert %{"id" => ^other_user_id, "following" => false, "requested" => true} =
 662                conn
 663                |> post("/api/v1/accounts/#{other_user_id}/follow")
 664                |> json_response_and_validate_schema(:ok)
 665
 666       assert %{"id" => ^other_user_id, "following" => false, "requested" => false} =
 667                conn
 668                |> post("/api/v1/accounts/#{other_user_id}/unfollow")
 669                |> json_response_and_validate_schema(:ok)
 670     end
 671
 672     test "following without reblogs" do
 673       %{conn: conn} = oauth_access(["follow", "read:statuses"])
 674       followed = insert(:user)
 675       other_user = insert(:user)
 676
 677       ret_conn = post(conn, "/api/v1/accounts/#{followed.id}/follow?reblogs=false")
 678
 679       assert %{"showing_reblogs" => false} = json_response_and_validate_schema(ret_conn, 200)
 680
 681       {:ok, activity} = CommonAPI.post(other_user, %{"status" => "hey"})
 682       {:ok, %{id: reblog_id}, _} = CommonAPI.repeat(activity.id, followed)
 683
 684       assert [] ==
 685                conn
 686                |> get("/api/v1/timelines/home")
 687                |> json_response(200)
 688
 689       assert %{"showing_reblogs" => true} =
 690                conn
 691                |> post("/api/v1/accounts/#{followed.id}/follow?reblogs=true")
 692                |> json_response_and_validate_schema(200)
 693
 694       assert [%{"id" => ^reblog_id}] =
 695                conn
 696                |> get("/api/v1/timelines/home")
 697                |> json_response(200)
 698     end
 699
 700     test "following / unfollowing errors", %{user: user, conn: conn} do
 701       # self follow
 702       conn_res = post(conn, "/api/v1/accounts/#{user.id}/follow")
 703
 704       assert %{"error" => "Can not follow yourself"} =
 705                json_response_and_validate_schema(conn_res, 400)
 706
 707       # self unfollow
 708       user = User.get_cached_by_id(user.id)
 709       conn_res = post(conn, "/api/v1/accounts/#{user.id}/unfollow")
 710
 711       assert %{"error" => "Can not unfollow yourself"} =
 712                json_response_and_validate_schema(conn_res, 400)
 713
 714       # self follow via uri
 715       user = User.get_cached_by_id(user.id)
 716
 717       assert %{"error" => "Can not follow yourself"} =
 718                conn
 719                |> put_req_header("content-type", "multipart/form-data")
 720                |> post("/api/v1/follows", %{"uri" => user.nickname})
 721                |> json_response_and_validate_schema(400)
 722
 723       # follow non existing user
 724       conn_res = post(conn, "/api/v1/accounts/doesntexist/follow")
 725       assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)
 726
 727       # follow non existing user via uri
 728       conn_res =
 729         conn
 730         |> put_req_header("content-type", "multipart/form-data")
 731         |> post("/api/v1/follows", %{"uri" => "doesntexist"})
 732
 733       assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)
 734
 735       # unfollow non existing user
 736       conn_res = post(conn, "/api/v1/accounts/doesntexist/unfollow")
 737       assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)
 738     end
 739   end
 740
 741   describe "mute/unmute" do
 742     setup do: oauth_access(["write:mutes"])
 743
 744     test "with notifications", %{conn: conn} do
 745       other_user = insert(:user)
 746
 747       assert %{"id" => _id, "muting" => true, "muting_notifications" => true} =
 748                conn
 749                |> put_req_header("content-type", "application/json")
 750                |> post("/api/v1/accounts/#{other_user.id}/mute")
 751                |> json_response_and_validate_schema(200)
 752
 753       conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")
 754
 755       assert %{"id" => _id, "muting" => false, "muting_notifications" => false} =
 756                json_response_and_validate_schema(conn, 200)
 757     end
 758
 759     test "without notifications", %{conn: conn} do
 760       other_user = insert(:user)
 761
 762       ret_conn =
 763         conn
 764         |> put_req_header("content-type", "multipart/form-data")
 765         |> post("/api/v1/accounts/#{other_user.id}/mute", %{"notifications" => "false"})
 766
 767       assert %{"id" => _id, "muting" => true, "muting_notifications" => false} =
 768                json_response_and_validate_schema(ret_conn, 200)
 769
 770       conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")
 771
 772       assert %{"id" => _id, "muting" => false, "muting_notifications" => false} =
 773                json_response_and_validate_schema(conn, 200)
 774     end
 775   end
 776
 777   describe "pinned statuses" do
 778     setup do
 779       user = insert(:user)
 780       {:ok, activity} = CommonAPI.post(user, %{"status" => "HI!!!"})
 781       %{conn: conn} = oauth_access(["read:statuses"], user: user)
 782
 783       [conn: conn, user: user, activity: activity]
 784     end
 785
 786     test "returns pinned statuses", %{conn: conn, user: user, activity: %{id: activity_id}} do
 787       {:ok, _} = CommonAPI.pin(activity_id, user)
 788
 789       assert [%{"id" => ^activity_id, "pinned" => true}] =
 790                conn
 791                |> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
 792                |> json_response_and_validate_schema(200)
 793     end
 794   end
 795
 796   test "blocking / unblocking a user" do
 797     %{conn: conn} = oauth_access(["follow"])
 798     other_user = insert(:user)
 799
 800     ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/block")
 801
 802     assert %{"id" => _id, "blocking" => true} = json_response_and_validate_schema(ret_conn, 200)
 803
 804     conn = post(conn, "/api/v1/accounts/#{other_user.id}/unblock")
 805
 806     assert %{"id" => _id, "blocking" => false} = json_response_and_validate_schema(conn, 200)
 807   end
 808
 809   describe "create account by app" do
 810     setup do
 811       valid_params = %{
 812         username: "lain",
 813         email: "lain@example.org",
 814         password: "PlzDontHackLain",
 815         agreement: true
 816       }
 817
 818       [valid_params: valid_params]
 819     end
 820
 821     setup do: clear_config([:instance, :account_activation_required])
 822
 823     test "Account registration via Application", %{conn: conn} do
 824       conn =
 825         conn
 826         |> put_req_header("content-type", "application/json")
 827         |> post("/api/v1/apps", %{
 828           client_name: "client_name",
 829           redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
 830           scopes: "read, write, follow"
 831         })
 832
 833       assert %{
 834                "client_id" => client_id,
 835                "client_secret" => client_secret,
 836                "id" => _,
 837                "name" => "client_name",
 838                "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
 839                "vapid_key" => _,
 840                "website" => nil
 841              } = json_response_and_validate_schema(conn, 200)
 842
 843       conn =
 844         post(conn, "/oauth/token", %{
 845           grant_type: "client_credentials",
 846           client_id: client_id,
 847           client_secret: client_secret
 848         })
 849
 850       assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
 851                json_response(conn, 200)
 852
 853       assert token
 854       token_from_db = Repo.get_by(Token, token: token)
 855       assert token_from_db
 856       assert refresh
 857       assert scope == "read write follow"
 858
 859       conn =
 860         build_conn()
 861         |> put_req_header("content-type", "multipart/form-data")
 862         |> put_req_header("authorization", "Bearer " <> token)
 863         |> post("/api/v1/accounts", %{
 864           username: "lain",
 865           email: "lain@example.org",
 866           password: "PlzDontHackLain",
 867           bio: "Test Bio",
 868           agreement: true
 869         })
 870
 871       %{
 872         "access_token" => token,
 873         "created_at" => _created_at,
 874         "scope" => _scope,
 875         "token_type" => "Bearer"
 876       } = json_response_and_validate_schema(conn, 200)
 877
 878       token_from_db = Repo.get_by(Token, token: token)
 879       assert token_from_db
 880       token_from_db = Repo.preload(token_from_db, :user)
 881       assert token_from_db.user
 882
 883       assert token_from_db.user.confirmation_pending
 884     end
 885
 886     test "returns error when user already registred", %{conn: conn, valid_params: valid_params} do
 887       _user = insert(:user, email: "lain@example.org")
 888       app_token = insert(:oauth_token, user: nil)
 889
 890       res =
 891         conn
 892         |> put_req_header("authorization", "Bearer " <> app_token.token)
 893         |> put_req_header("content-type", "application/json")
 894         |> post("/api/v1/accounts", valid_params)
 895
 896       assert json_response_and_validate_schema(res, 400) == %{
 897                "error" => "{\"email\":[\"has already been taken\"]}"
 898              }
 899     end
 900
 901     test "returns bad_request if missing required params", %{
 902       conn: conn,
 903       valid_params: valid_params
 904     } do
 905       app_token = insert(:oauth_token, user: nil)
 906
 907       conn =
 908         conn
 909         |> put_req_header("authorization", "Bearer " <> app_token.token)
 910         |> put_req_header("content-type", "application/json")
 911
 912       res = post(conn, "/api/v1/accounts", valid_params)
 913       assert json_response_and_validate_schema(res, 200)
 914
 915       [{127, 0, 0, 1}, {127, 0, 0, 2}, {127, 0, 0, 3}, {127, 0, 0, 4}]
 916       |> Stream.zip(Map.delete(valid_params, :email))
 917       |> Enum.each(fn {ip, {attr, _}} ->
 918         res =
 919           conn
 920           |> Map.put(:remote_ip, ip)
 921           |> post("/api/v1/accounts", Map.delete(valid_params, attr))
 922           |> json_response_and_validate_schema(400)
 923
 924         assert res == %{
 925                  "error" => "Missing field: #{attr}.",
 926                  "errors" => [
 927                    %{
 928                      "message" => "Missing field: #{attr}",
 929                      "source" => %{"pointer" => "/#{attr}"},
 930                      "title" => "Invalid value"
 931                    }
 932                  ]
 933                }
 934       end)
 935     end
 936
 937     setup do: clear_config([:instance, :account_activation_required])
 938
 939     test "returns bad_request if missing email params when :account_activation_required is enabled",
 940          %{conn: conn, valid_params: valid_params} do
 941       Pleroma.Config.put([:instance, :account_activation_required], true)
 942
 943       app_token = insert(:oauth_token, user: nil)
 944
 945       conn =
 946         conn
 947         |> put_req_header("authorization", "Bearer " <> app_token.token)
 948         |> put_req_header("content-type", "application/json")
 949
 950       res =
 951         conn
 952         |> Map.put(:remote_ip, {127, 0, 0, 5})
 953         |> post("/api/v1/accounts", Map.delete(valid_params, :email))
 954
 955       assert json_response_and_validate_schema(res, 400) ==
 956                %{"error" => "Missing parameter: email"}
 957
 958       res =
 959         conn
 960         |> Map.put(:remote_ip, {127, 0, 0, 6})
 961         |> post("/api/v1/accounts", Map.put(valid_params, :email, ""))
 962
 963       assert json_response_and_validate_schema(res, 400) == %{
 964                "error" => "{\"email\":[\"can't be blank\"]}"
 965              }
 966     end
 967
 968     test "allow registration without an email", %{conn: conn, valid_params: valid_params} do
 969       app_token = insert(:oauth_token, user: nil)
 970       conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
 971
 972       res =
 973         conn
 974         |> put_req_header("content-type", "application/json")
 975         |> Map.put(:remote_ip, {127, 0, 0, 7})
 976         |> post("/api/v1/accounts", Map.delete(valid_params, :email))
 977
 978       assert json_response_and_validate_schema(res, 200)
 979     end
 980
 981     test "allow registration with an empty email", %{conn: conn, valid_params: valid_params} do
 982       app_token = insert(:oauth_token, user: nil)
 983       conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
 984
 985       res =
 986         conn
 987         |> put_req_header("content-type", "application/json")
 988         |> Map.put(:remote_ip, {127, 0, 0, 8})
 989         |> post("/api/v1/accounts", Map.put(valid_params, :email, ""))
 990
 991       assert json_response_and_validate_schema(res, 200)
 992     end
 993
 994     test "returns forbidden if token is invalid", %{conn: conn, valid_params: valid_params} do
 995       res =
 996         conn
 997         |> put_req_header("authorization", "Bearer " <> "invalid-token")
 998         |> put_req_header("content-type", "multipart/form-data")
 999         |> post("/api/v1/accounts", valid_params)
1000
1001       assert json_response_and_validate_schema(res, 403) == %{"error" => "Invalid credentials"}
1002     end
1003
1004     test "registration from trusted app" do
1005       clear_config([Pleroma.Captcha, :enabled], true)
1006       app = insert(:oauth_app, trusted: true, scopes: ["read", "write", "follow", "push"])
1007
1008       conn =
1009         build_conn()
1010         |> post("/oauth/token", %{
1011           "grant_type" => "client_credentials",
1012           "client_id" => app.client_id,
1013           "client_secret" => app.client_secret
1014         })
1015
1016       assert %{"access_token" => token, "token_type" => "Bearer"} = json_response(conn, 200)
1017
1018       response =
1019         build_conn()
1020         |> Plug.Conn.put_req_header("authorization", "Bearer " <> token)
1021         |> put_req_header("content-type", "multipart/form-data")
1022         |> post("/api/v1/accounts", %{
1023           nickname: "nickanme",
1024           agreement: true,
1025           email: "email@example.com",
1026           fullname: "Lain",
1027           username: "Lain",
1028           password: "some_password",
1029           confirm: "some_password"
1030         })
1031         |> json_response_and_validate_schema(200)
1032
1033       assert %{
1034                "access_token" => access_token,
1035                "created_at" => _,
1036                "scope" => ["read", "write", "follow", "push"],
1037                "token_type" => "Bearer"
1038              } = response
1039
1040       response =
1041         build_conn()
1042         |> Plug.Conn.put_req_header("authorization", "Bearer " <> access_token)
1043         |> get("/api/v1/accounts/verify_credentials")
1044         |> json_response_and_validate_schema(200)
1045
1046       assert %{
1047                "acct" => "Lain",
1048                "bot" => false,
1049                "display_name" => "Lain",
1050                "follow_requests_count" => 0,
1051                "followers_count" => 0,
1052                "following_count" => 0,
1053                "locked" => false,
1054                "note" => "",
1055                "source" => %{
1056                  "fields" => [],
1057                  "note" => "",
1058                  "pleroma" => %{
1059                    "actor_type" => "Person",
1060                    "discoverable" => false,
1061                    "no_rich_text" => false,
1062                    "show_role" => true
1063                  },
1064                  "privacy" => "public",
1065                  "sensitive" => false
1066                },
1067                "statuses_count" => 0,
1068                "username" => "Lain"
1069              } = response
1070     end
1071   end
1072
1073   describe "create account by app / rate limit" do
1074     setup do: clear_config([:rate_limit, :app_account_creation], {10_000, 2})
1075
1076     test "respects rate limit setting", %{conn: conn} do
1077       app_token = insert(:oauth_token, user: nil)
1078
1079       conn =
1080         conn
1081         |> put_req_header("authorization", "Bearer " <> app_token.token)
1082         |> Map.put(:remote_ip, {15, 15, 15, 15})
1083         |> put_req_header("content-type", "multipart/form-data")
1084
1085       for i <- 1..2 do
1086         conn =
1087           conn
1088           |> post("/api/v1/accounts", %{
1089             username: "#{i}lain",
1090             email: "#{i}lain@example.org",
1091             password: "PlzDontHackLain",
1092             agreement: true
1093           })
1094
1095         %{
1096           "access_token" => token,
1097           "created_at" => _created_at,
1098           "scope" => _scope,
1099           "token_type" => "Bearer"
1100         } = json_response_and_validate_schema(conn, 200)
1101
1102         token_from_db = Repo.get_by(Token, token: token)
1103         assert token_from_db
1104         token_from_db = Repo.preload(token_from_db, :user)
1105         assert token_from_db.user
1106
1107         assert token_from_db.user.confirmation_pending
1108       end
1109
1110       conn =
1111         post(conn, "/api/v1/accounts", %{
1112           username: "6lain",
1113           email: "6lain@example.org",
1114           password: "PlzDontHackLain",
1115           agreement: true
1116         })
1117
1118       assert json_response_and_validate_schema(conn, :too_many_requests) == %{
1119                "error" => "Throttled"
1120              }
1121     end
1122   end
1123
1124   describe "create account with enabled captcha" do
1125     setup %{conn: conn} do
1126       app_token = insert(:oauth_token, user: nil)
1127
1128       conn =
1129         conn
1130         |> put_req_header("authorization", "Bearer " <> app_token.token)
1131         |> put_req_header("content-type", "multipart/form-data")
1132
1133       [conn: conn]
1134     end
1135
1136     setup do: clear_config([Pleroma.Captcha, :enabled], true)
1137
1138     test "creates an account and returns 200 if captcha is valid", %{conn: conn} do
1139       %{token: token, answer_data: answer_data} = Pleroma.Captcha.new()
1140
1141       params = %{
1142         username: "lain",
1143         email: "lain@example.org",
1144         password: "PlzDontHackLain",
1145         agreement: true,
1146         captcha_solution: Pleroma.Captcha.Mock.solution(),
1147         captcha_token: token,
1148         captcha_answer_data: answer_data
1149       }
1150
1151       assert %{
1152                "access_token" => access_token,
1153                "created_at" => _,
1154                "scope" => ["read"],
1155                "token_type" => "Bearer"
1156              } =
1157                conn
1158                |> post("/api/v1/accounts", params)
1159                |> json_response_and_validate_schema(:ok)
1160
1161       assert Token |> Repo.get_by(token: access_token) |> Repo.preload(:user) |> Map.get(:user)
1162
1163       Cachex.del(:used_captcha_cache, token)
1164     end
1165
1166     test "returns 400 if any captcha field is not provided", %{conn: conn} do
1167       captcha_fields = [:captcha_solution, :captcha_token, :captcha_answer_data]
1168
1169       valid_params = %{
1170         username: "lain",
1171         email: "lain@example.org",
1172         password: "PlzDontHackLain",
1173         agreement: true,
1174         captcha_solution: "xx",
1175         captcha_token: "xx",
1176         captcha_answer_data: "xx"
1177       }
1178
1179       for field <- captcha_fields do
1180         expected = %{
1181           "error" => "{\"captcha\":[\"Invalid CAPTCHA (Missing parameter: #{field})\"]}"
1182         }
1183
1184         assert expected ==
1185                  conn
1186                  |> post("/api/v1/accounts", Map.delete(valid_params, field))
1187                  |> json_response_and_validate_schema(:bad_request)
1188       end
1189     end
1190
1191     test "returns an error if captcha is invalid", %{conn: conn} do
1192       params = %{
1193         username: "lain",
1194         email: "lain@example.org",
1195         password: "PlzDontHackLain",
1196         agreement: true,
1197         captcha_solution: "cofe",
1198         captcha_token: "cofe",
1199         captcha_answer_data: "cofe"
1200       }
1201
1202       assert %{"error" => "{\"captcha\":[\"Invalid answer data\"]}"} ==
1203                conn
1204                |> post("/api/v1/accounts", params)
1205                |> json_response_and_validate_schema(:bad_request)
1206     end
1207   end
1208
1209   describe "GET /api/v1/accounts/:id/lists - account_lists" do
1210     test "returns lists to which the account belongs" do
1211       %{user: user, conn: conn} = oauth_access(["read:lists"])
1212       other_user = insert(:user)
1213       assert {:ok, %Pleroma.List{id: list_id} = list} = Pleroma.List.create("Test List", user)
1214       {:ok, %{following: _following}} = Pleroma.List.follow(list, other_user)
1215
1216       assert [%{"id" => list_id, "title" => "Test List"}] =
1217                conn
1218                |> get("/api/v1/accounts/#{other_user.id}/lists")
1219                |> json_response_and_validate_schema(200)
1220     end
1221   end
1222
1223   describe "verify_credentials" do
1224     test "verify_credentials" do
1225       %{user: user, conn: conn} = oauth_access(["read:accounts"])
1226       [notification | _] = insert_list(7, :notification, user: user)
1227       Pleroma.Notification.set_read_up_to(user, notification.id)
1228       conn = get(conn, "/api/v1/accounts/verify_credentials")
1229
1230       response = json_response_and_validate_schema(conn, 200)
1231
1232       assert %{"id" => id, "source" => %{"privacy" => "public"}} = response
1233       assert response["pleroma"]["chat_token"]
1234       assert response["pleroma"]["unread_notifications_count"] == 6
1235       assert id == to_string(user.id)
1236     end
1237
1238     test "verify_credentials default scope unlisted" do
1239       user = insert(:user, default_scope: "unlisted")
1240       %{conn: conn} = oauth_access(["read:accounts"], user: user)
1241
1242       conn = get(conn, "/api/v1/accounts/verify_credentials")
1243
1244       assert %{"id" => id, "source" => %{"privacy" => "unlisted"}} =
1245                json_response_and_validate_schema(conn, 200)
1246
1247       assert id == to_string(user.id)
1248     end
1249
1250     test "locked accounts" do
1251       user = insert(:user, default_scope: "private")
1252       %{conn: conn} = oauth_access(["read:accounts"], user: user)
1253
1254       conn = get(conn, "/api/v1/accounts/verify_credentials")
1255
1256       assert %{"id" => id, "source" => %{"privacy" => "private"}} =
1257                json_response_and_validate_schema(conn, 200)
1258
1259       assert id == to_string(user.id)
1260     end
1261   end
1262
1263   describe "user relationships" do
1264     setup do: oauth_access(["read:follows"])
1265
1266     test "returns the relationships for the current user", %{user: user, conn: conn} do
1267       %{id: other_user_id} = other_user = insert(:user)
1268       {:ok, _user} = User.follow(user, other_user)
1269
1270       assert [%{"id" => ^other_user_id}] =
1271                conn
1272                |> get("/api/v1/accounts/relationships?id=#{other_user.id}")
1273                |> json_response_and_validate_schema(200)
1274
1275       assert [%{"id" => ^other_user_id}] =
1276                conn
1277                |> get("/api/v1/accounts/relationships?id[]=#{other_user.id}")
1278                |> json_response_and_validate_schema(200)
1279     end
1280
1281     test "returns an empty list on a bad request", %{conn: conn} do
1282       conn = get(conn, "/api/v1/accounts/relationships", %{})
1283
1284       assert [] = json_response_and_validate_schema(conn, 200)
1285     end
1286   end
1287
1288   test "getting a list of mutes" do
1289     %{user: user, conn: conn} = oauth_access(["read:mutes"])
1290     other_user = insert(:user)
1291
1292     {:ok, _user_relationships} = User.mute(user, other_user)
1293
1294     conn = get(conn, "/api/v1/mutes")
1295
1296     other_user_id = to_string(other_user.id)
1297     assert [%{"id" => ^other_user_id}] = json_response_and_validate_schema(conn, 200)
1298   end
1299
1300   test "getting a list of blocks" do
1301     %{user: user, conn: conn} = oauth_access(["read:blocks"])
1302     other_user = insert(:user)
1303
1304     {:ok, _user_relationship} = User.block(user, other_user)
1305
1306     conn =
1307       conn
1308       |> assign(:user, user)
1309       |> get("/api/v1/blocks")
1310
1311     other_user_id = to_string(other_user.id)
1312     assert [%{"id" => ^other_user_id}] = json_response_and_validate_schema(conn, 200)
1313   end
1314 end