1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Web.MastodonAPI.AccountControllerTest do
6 use Pleroma.Web.ConnCase
11 alias Pleroma.Web.ActivityPub.ActivityPub
12 alias Pleroma.Web.ActivityPub.InternalFetchActor
13 alias Pleroma.Web.CommonAPI
14 alias Pleroma.Web.OAuth.Token
16 import Pleroma.Factory
18 describe "account fetching" do
19 setup do: clear_config([:instance, :limit_to_local_content])
22 %User{id: user_id} = insert(:user)
24 assert %{"id" => ^user_id} =
26 |> get("/api/v1/accounts/#{user_id}")
27 |> json_response_and_validate_schema(200)
29 assert %{"error" => "Can't find user"} =
31 |> get("/api/v1/accounts/-1")
32 |> json_response_and_validate_schema(404)
35 test "works by nickname" do
38 assert %{"id" => user_id} =
40 |> get("/api/v1/accounts/#{user.nickname}")
41 |> json_response_and_validate_schema(200)
44 test "works by nickname for remote users" do
45 Config.put([:instance, :limit_to_local_content], false)
47 user = insert(:user, nickname: "user@example.com", local: false)
49 assert %{"id" => user_id} =
51 |> get("/api/v1/accounts/#{user.nickname}")
52 |> json_response_and_validate_schema(200)
55 test "respects limit_to_local_content == :all for remote user nicknames" do
56 Config.put([:instance, :limit_to_local_content], :all)
58 user = insert(:user, nickname: "user@example.com", local: false)
61 |> get("/api/v1/accounts/#{user.nickname}")
62 |> json_response_and_validate_schema(404)
65 test "respects limit_to_local_content == :unauthenticated for remote user nicknames" do
66 Config.put([:instance, :limit_to_local_content], :unauthenticated)
68 user = insert(:user, nickname: "user@example.com", local: false)
69 reading_user = insert(:user)
73 |> get("/api/v1/accounts/#{user.nickname}")
75 assert json_response_and_validate_schema(conn, 404)
79 |> assign(:user, reading_user)
80 |> assign(:token, insert(:oauth_token, user: reading_user, scopes: ["read:accounts"]))
81 |> get("/api/v1/accounts/#{user.nickname}")
83 assert %{"id" => id} = json_response_and_validate_schema(conn, 200)
87 test "accounts fetches correct account for nicknames beginning with numbers", %{conn: conn} do
88 # Need to set an old-style integer ID to reproduce the problem
89 # (these are no longer assigned to new accounts but were preserved
90 # for existing accounts during the migration to flakeIDs)
91 user_one = insert(:user, %{id: 1212})
92 user_two = insert(:user, %{nickname: "#{user_one.id}garbage"})
96 |> get("/api/v1/accounts/#{user_one.id}")
97 |> json_response_and_validate_schema(:ok)
101 |> get("/api/v1/accounts/#{user_two.nickname}")
102 |> json_response_and_validate_schema(:ok)
106 |> get("/api/v1/accounts/#{user_two.id}")
107 |> json_response_and_validate_schema(:ok)
109 refute acc_one == acc_two
110 assert acc_two == acc_three
113 test "returns 404 when user is invisible", %{conn: conn} do
114 user = insert(:user, %{invisible: true})
116 assert %{"error" => "Can't find user"} =
118 |> get("/api/v1/accounts/#{user.nickname}")
119 |> json_response_and_validate_schema(404)
122 test "returns 404 for internal.fetch actor", %{conn: conn} do
123 %User{nickname: "internal.fetch"} = InternalFetchActor.get_actor()
125 assert %{"error" => "Can't find user"} =
127 |> get("/api/v1/accounts/internal.fetch")
128 |> json_response_and_validate_schema(404)
132 defp local_and_remote_users do
133 local = insert(:user)
134 remote = insert(:user, local: false)
135 {:ok, local: local, remote: remote}
138 describe "user fetching with restrict unauthenticated profiles for local and remote" do
139 setup do: local_and_remote_users()
141 setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
143 setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
145 test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
146 assert %{"error" => "Can't find user"} ==
148 |> get("/api/v1/accounts/#{local.id}")
149 |> json_response_and_validate_schema(:not_found)
151 assert %{"error" => "Can't find user"} ==
153 |> get("/api/v1/accounts/#{remote.id}")
154 |> json_response_and_validate_schema(:not_found)
157 test "if user is authenticated", %{local: local, remote: remote} do
158 %{conn: conn} = oauth_access(["read"])
160 res_conn = get(conn, "/api/v1/accounts/#{local.id}")
161 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
163 res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
164 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
168 describe "user fetching with restrict unauthenticated profiles for local" do
169 setup do: local_and_remote_users()
171 setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
173 test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
174 res_conn = get(conn, "/api/v1/accounts/#{local.id}")
176 assert json_response_and_validate_schema(res_conn, :not_found) == %{
177 "error" => "Can't find user"
180 res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
181 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
184 test "if user is authenticated", %{local: local, remote: remote} do
185 %{conn: conn} = oauth_access(["read"])
187 res_conn = get(conn, "/api/v1/accounts/#{local.id}")
188 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
190 res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
191 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
195 describe "user fetching with restrict unauthenticated profiles for remote" do
196 setup do: local_and_remote_users()
198 setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
200 test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
201 res_conn = get(conn, "/api/v1/accounts/#{local.id}")
202 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
204 res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
206 assert json_response_and_validate_schema(res_conn, :not_found) == %{
207 "error" => "Can't find user"
211 test "if user is authenticated", %{local: local, remote: remote} do
212 %{conn: conn} = oauth_access(["read"])
214 res_conn = get(conn, "/api/v1/accounts/#{local.id}")
215 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
217 res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
218 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
222 describe "user timelines" do
223 setup do: oauth_access(["read:statuses"])
225 test "works with announces that are just addressed to public", %{conn: conn} do
226 user = insert(:user, ap_id: "https://honktest/u/test", local: false)
227 other_user = insert(:user)
229 {:ok, post} = CommonAPI.post(other_user, %{"status" => "bonkeronk"})
233 "@context" => "https://www.w3.org/ns/activitystreams",
234 "actor" => "https://honktest/u/test",
235 "id" => "https://honktest/u/test/bonk/1793M7B9MQ48847vdx",
236 "object" => post.data["object"],
237 "published" => "2019-06-25T19:33:58Z",
238 "to" => ["https://www.w3.org/ns/activitystreams#Public"],
241 |> ActivityPub.persist(local: false)
245 |> get("/api/v1/accounts/#{user.id}/statuses")
246 |> json_response_and_validate_schema(200)
248 assert [%{"id" => id}] = resp
249 assert id == announce.id
252 test "respects blocks", %{user: user_one, conn: conn} do
253 user_two = insert(:user)
254 user_three = insert(:user)
256 User.block(user_one, user_two)
258 {:ok, activity} = CommonAPI.post(user_two, %{"status" => "User one sux0rz"})
259 {:ok, repeat, _} = CommonAPI.repeat(activity.id, user_three)
263 |> get("/api/v1/accounts/#{user_two.id}/statuses")
264 |> json_response_and_validate_schema(200)
266 assert [%{"id" => id}] = resp
267 assert id == activity.id
269 # Even a blocked user will deliver the full user timeline, there would be
270 # no point in looking at a blocked users timeline otherwise
273 |> get("/api/v1/accounts/#{user_two.id}/statuses")
274 |> json_response_and_validate_schema(200)
276 assert [%{"id" => id}] = resp
277 assert id == activity.id
279 # Third user's timeline includes the repeat when viewed by unauthenticated user
282 |> get("/api/v1/accounts/#{user_three.id}/statuses")
283 |> json_response_and_validate_schema(200)
285 assert [%{"id" => id}] = resp
286 assert id == repeat.id
288 # When viewing a third user's timeline, the blocked users' statuses will NOT be shown
289 resp = get(conn, "/api/v1/accounts/#{user_three.id}/statuses")
291 assert [] == json_response_and_validate_schema(resp, 200)
294 test "gets users statuses", %{conn: conn} do
295 user_one = insert(:user)
296 user_two = insert(:user)
297 user_three = insert(:user)
299 {:ok, _user_three} = User.follow(user_three, user_one)
301 {:ok, activity} = CommonAPI.post(user_one, %{"status" => "HI!!!"})
303 {:ok, direct_activity} =
304 CommonAPI.post(user_one, %{
305 "status" => "Hi, @#{user_two.nickname}.",
306 "visibility" => "direct"
309 {:ok, private_activity} =
310 CommonAPI.post(user_one, %{"status" => "private", "visibility" => "private"})
315 |> get("/api/v1/accounts/#{user_one.id}/statuses")
316 |> json_response_and_validate_schema(200)
318 assert [%{"id" => id}] = resp
319 assert id == to_string(activity.id)
323 |> assign(:user, user_two)
324 |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
325 |> get("/api/v1/accounts/#{user_one.id}/statuses")
326 |> json_response_and_validate_schema(200)
328 assert [%{"id" => id_one}, %{"id" => id_two}] = resp
329 assert id_one == to_string(direct_activity.id)
330 assert id_two == to_string(activity.id)
334 |> assign(:user, user_three)
335 |> assign(:token, insert(:oauth_token, user: user_three, scopes: ["read:statuses"]))
336 |> get("/api/v1/accounts/#{user_one.id}/statuses")
337 |> json_response_and_validate_schema(200)
339 assert [%{"id" => id_one}, %{"id" => id_two}] = resp
340 assert id_one == to_string(private_activity.id)
341 assert id_two == to_string(activity.id)
344 test "unimplemented pinned statuses feature", %{conn: conn} do
345 note = insert(:note_activity)
346 user = User.get_cached_by_ap_id(note.data["actor"])
348 conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?pinned=true")
350 assert json_response_and_validate_schema(conn, 200) == []
353 test "gets an users media", %{conn: conn} do
354 note = insert(:note_activity)
355 user = User.get_cached_by_ap_id(note.data["actor"])
358 content_type: "image/jpg",
359 path: Path.absname("test/fixtures/image.jpg"),
360 filename: "an_image.jpg"
363 {:ok, %{id: media_id}} = ActivityPub.upload(file, actor: user.ap_id)
365 {:ok, %{id: image_post_id}} =
366 CommonAPI.post(user, %{"status" => "cofe", "media_ids" => [media_id]})
368 conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?only_media=true")
370 assert [%{"id" => ^image_post_id}] = json_response_and_validate_schema(conn, 200)
372 conn = get(build_conn(), "/api/v1/accounts/#{user.id}/statuses?only_media=1")
374 assert [%{"id" => ^image_post_id}] = json_response_and_validate_schema(conn, 200)
377 test "gets a user's statuses without reblogs", %{user: user, conn: conn} do
378 {:ok, %{id: post_id}} = CommonAPI.post(user, %{"status" => "HI!!!"})
379 {:ok, _, _} = CommonAPI.repeat(post_id, user)
381 conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_reblogs=true")
382 assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)
384 conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_reblogs=1")
385 assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)
388 test "filters user's statuses by a hashtag", %{user: user, conn: conn} do
389 {:ok, %{id: post_id}} = CommonAPI.post(user, %{"status" => "#hashtag"})
390 {:ok, _post} = CommonAPI.post(user, %{"status" => "hashtag"})
392 conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?tagged=hashtag")
393 assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)
396 test "the user views their own timelines and excludes direct messages", %{
400 {:ok, %{id: public_activity_id}} =
401 CommonAPI.post(user, %{"status" => ".", "visibility" => "public"})
403 {:ok, _direct_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "direct"})
405 conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_visibilities[]=direct")
406 assert [%{"id" => ^public_activity_id}] = json_response_and_validate_schema(conn, 200)
410 defp local_and_remote_activities(%{local: local, remote: remote}) do
411 insert(:note_activity, user: local)
412 insert(:note_activity, user: remote, local: false)
417 describe "statuses with restrict unauthenticated profiles for local and remote" do
418 setup do: local_and_remote_users()
419 setup :local_and_remote_activities
421 setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
423 setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
425 test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
426 assert %{"error" => "Can't find user"} ==
428 |> get("/api/v1/accounts/#{local.id}/statuses")
429 |> json_response_and_validate_schema(:not_found)
431 assert %{"error" => "Can't find user"} ==
433 |> get("/api/v1/accounts/#{remote.id}/statuses")
434 |> json_response_and_validate_schema(:not_found)
437 test "if user is authenticated", %{local: local, remote: remote} do
438 %{conn: conn} = oauth_access(["read"])
440 res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
441 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
443 res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
444 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
448 describe "statuses with restrict unauthenticated profiles for local" do
449 setup do: local_and_remote_users()
450 setup :local_and_remote_activities
452 setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
454 test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
455 assert %{"error" => "Can't find user"} ==
457 |> get("/api/v1/accounts/#{local.id}/statuses")
458 |> json_response_and_validate_schema(:not_found)
460 res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
461 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
464 test "if user is authenticated", %{local: local, remote: remote} do
465 %{conn: conn} = oauth_access(["read"])
467 res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
468 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
470 res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
471 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
475 describe "statuses with restrict unauthenticated profiles for remote" do
476 setup do: local_and_remote_users()
477 setup :local_and_remote_activities
479 setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
481 test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
482 res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
483 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
485 assert %{"error" => "Can't find user"} ==
487 |> get("/api/v1/accounts/#{remote.id}/statuses")
488 |> json_response_and_validate_schema(:not_found)
491 test "if user is authenticated", %{local: local, remote: remote} do
492 %{conn: conn} = oauth_access(["read"])
494 res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
495 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
497 res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
498 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
502 describe "followers" do
503 setup do: oauth_access(["read:accounts"])
505 test "getting followers", %{user: user, conn: conn} do
506 other_user = insert(:user)
507 {:ok, %{id: user_id}} = User.follow(user, other_user)
509 conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")
511 assert [%{"id" => ^user_id}] = json_response_and_validate_schema(conn, 200)
514 test "getting followers, hide_followers", %{user: user, conn: conn} do
515 other_user = insert(:user, hide_followers: true)
516 {:ok, _user} = User.follow(user, other_user)
518 conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")
520 assert [] == json_response_and_validate_schema(conn, 200)
523 test "getting followers, hide_followers, same user requesting" do
525 other_user = insert(:user, hide_followers: true)
526 {:ok, _user} = User.follow(user, other_user)
530 |> assign(:user, other_user)
531 |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
532 |> get("/api/v1/accounts/#{other_user.id}/followers")
534 refute [] == json_response_and_validate_schema(conn, 200)
537 test "getting followers, pagination", %{user: user, conn: conn} do
538 {:ok, %User{id: follower1_id}} = :user |> insert() |> User.follow(user)
539 {:ok, %User{id: follower2_id}} = :user |> insert() |> User.follow(user)
540 {:ok, %User{id: follower3_id}} = :user |> insert() |> User.follow(user)
542 assert [%{"id" => ^follower3_id}, %{"id" => ^follower2_id}] =
544 |> get("/api/v1/accounts/#{user.id}/followers?since_id=#{follower1_id}")
545 |> json_response_and_validate_schema(200)
547 assert [%{"id" => ^follower2_id}, %{"id" => ^follower1_id}] =
549 |> get("/api/v1/accounts/#{user.id}/followers?max_id=#{follower3_id}")
550 |> json_response_and_validate_schema(200)
552 res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?limit=1&max_id=#{follower3_id}")
554 assert [%{"id" => ^follower2_id}] = json_response_and_validate_schema(res_conn, 200)
556 assert [link_header] = get_resp_header(res_conn, "link")
557 assert link_header =~ ~r/min_id=#{follower2_id}/
558 assert link_header =~ ~r/max_id=#{follower2_id}/
562 describe "following" do
563 setup do: oauth_access(["read:accounts"])
565 test "getting following", %{user: user, conn: conn} do
566 other_user = insert(:user)
567 {:ok, user} = User.follow(user, other_user)
569 conn = get(conn, "/api/v1/accounts/#{user.id}/following")
571 assert [%{"id" => id}] = json_response_and_validate_schema(conn, 200)
572 assert id == to_string(other_user.id)
575 test "getting following, hide_follows, other user requesting" do
576 user = insert(:user, hide_follows: true)
577 other_user = insert(:user)
578 {:ok, user} = User.follow(user, other_user)
582 |> assign(:user, other_user)
583 |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
584 |> get("/api/v1/accounts/#{user.id}/following")
586 assert [] == json_response_and_validate_schema(conn, 200)
589 test "getting following, hide_follows, same user requesting" do
590 user = insert(:user, hide_follows: true)
591 other_user = insert(:user)
592 {:ok, user} = User.follow(user, other_user)
596 |> assign(:user, user)
597 |> assign(:token, insert(:oauth_token, user: user, scopes: ["read:accounts"]))
598 |> get("/api/v1/accounts/#{user.id}/following")
600 refute [] == json_response_and_validate_schema(conn, 200)
603 test "getting following, pagination", %{user: user, conn: conn} do
604 following1 = insert(:user)
605 following2 = insert(:user)
606 following3 = insert(:user)
607 {:ok, _} = User.follow(user, following1)
608 {:ok, _} = User.follow(user, following2)
609 {:ok, _} = User.follow(user, following3)
611 res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?since_id=#{following1.id}")
613 assert [%{"id" => id3}, %{"id" => id2}] = json_response_and_validate_schema(res_conn, 200)
614 assert id3 == following3.id
615 assert id2 == following2.id
617 res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?max_id=#{following3.id}")
619 assert [%{"id" => id2}, %{"id" => id1}] = json_response_and_validate_schema(res_conn, 200)
620 assert id2 == following2.id
621 assert id1 == following1.id
624 get(conn, "/api/v1/accounts/#{user.id}/following?limit=1&max_id=#{following3.id}")
626 assert [%{"id" => id2}] = json_response_and_validate_schema(res_conn, 200)
627 assert id2 == following2.id
629 assert [link_header] = get_resp_header(res_conn, "link")
630 assert link_header =~ ~r/min_id=#{following2.id}/
631 assert link_header =~ ~r/max_id=#{following2.id}/
635 describe "follow/unfollow" do
636 setup do: oauth_access(["follow"])
638 test "following / unfollowing a user", %{conn: conn} do
639 %{id: other_user_id, nickname: other_user_nickname} = insert(:user)
641 assert %{"id" => _id, "following" => true} =
643 |> post("/api/v1/accounts/#{other_user_id}/follow")
644 |> json_response_and_validate_schema(200)
646 assert %{"id" => _id, "following" => false} =
648 |> post("/api/v1/accounts/#{other_user_id}/unfollow")
649 |> json_response_and_validate_schema(200)
651 assert %{"id" => ^other_user_id} =
653 |> put_req_header("content-type", "application/json")
654 |> post("/api/v1/follows", %{"uri" => other_user_nickname})
655 |> json_response_and_validate_schema(200)
658 test "cancelling follow request", %{conn: conn} do
659 %{id: other_user_id} = insert(:user, %{locked: true})
661 assert %{"id" => ^other_user_id, "following" => false, "requested" => true} =
663 |> post("/api/v1/accounts/#{other_user_id}/follow")
664 |> json_response_and_validate_schema(:ok)
666 assert %{"id" => ^other_user_id, "following" => false, "requested" => false} =
668 |> post("/api/v1/accounts/#{other_user_id}/unfollow")
669 |> json_response_and_validate_schema(:ok)
672 test "following without reblogs" do
673 %{conn: conn} = oauth_access(["follow", "read:statuses"])
674 followed = insert(:user)
675 other_user = insert(:user)
677 ret_conn = post(conn, "/api/v1/accounts/#{followed.id}/follow?reblogs=false")
679 assert %{"showing_reblogs" => false} = json_response_and_validate_schema(ret_conn, 200)
681 {:ok, activity} = CommonAPI.post(other_user, %{"status" => "hey"})
682 {:ok, %{id: reblog_id}, _} = CommonAPI.repeat(activity.id, followed)
686 |> get("/api/v1/timelines/home")
687 |> json_response(200)
689 assert %{"showing_reblogs" => true} =
691 |> post("/api/v1/accounts/#{followed.id}/follow?reblogs=true")
692 |> json_response_and_validate_schema(200)
694 assert [%{"id" => ^reblog_id}] =
696 |> get("/api/v1/timelines/home")
697 |> json_response(200)
700 test "following / unfollowing errors", %{user: user, conn: conn} do
702 conn_res = post(conn, "/api/v1/accounts/#{user.id}/follow")
704 assert %{"error" => "Can not follow yourself"} =
705 json_response_and_validate_schema(conn_res, 400)
708 user = User.get_cached_by_id(user.id)
709 conn_res = post(conn, "/api/v1/accounts/#{user.id}/unfollow")
711 assert %{"error" => "Can not unfollow yourself"} =
712 json_response_and_validate_schema(conn_res, 400)
714 # self follow via uri
715 user = User.get_cached_by_id(user.id)
717 assert %{"error" => "Can not follow yourself"} =
719 |> put_req_header("content-type", "multipart/form-data")
720 |> post("/api/v1/follows", %{"uri" => user.nickname})
721 |> json_response_and_validate_schema(400)
723 # follow non existing user
724 conn_res = post(conn, "/api/v1/accounts/doesntexist/follow")
725 assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)
727 # follow non existing user via uri
730 |> put_req_header("content-type", "multipart/form-data")
731 |> post("/api/v1/follows", %{"uri" => "doesntexist"})
733 assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)
735 # unfollow non existing user
736 conn_res = post(conn, "/api/v1/accounts/doesntexist/unfollow")
737 assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)
741 describe "mute/unmute" do
742 setup do: oauth_access(["write:mutes"])
744 test "with notifications", %{conn: conn} do
745 other_user = insert(:user)
747 assert %{"id" => _id, "muting" => true, "muting_notifications" => true} =
749 |> put_req_header("content-type", "application/json")
750 |> post("/api/v1/accounts/#{other_user.id}/mute")
751 |> json_response_and_validate_schema(200)
753 conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")
755 assert %{"id" => _id, "muting" => false, "muting_notifications" => false} =
756 json_response_and_validate_schema(conn, 200)
759 test "without notifications", %{conn: conn} do
760 other_user = insert(:user)
764 |> put_req_header("content-type", "multipart/form-data")
765 |> post("/api/v1/accounts/#{other_user.id}/mute", %{"notifications" => "false"})
767 assert %{"id" => _id, "muting" => true, "muting_notifications" => false} =
768 json_response_and_validate_schema(ret_conn, 200)
770 conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")
772 assert %{"id" => _id, "muting" => false, "muting_notifications" => false} =
773 json_response_and_validate_schema(conn, 200)
777 describe "pinned statuses" do
780 {:ok, activity} = CommonAPI.post(user, %{"status" => "HI!!!"})
781 %{conn: conn} = oauth_access(["read:statuses"], user: user)
783 [conn: conn, user: user, activity: activity]
786 test "returns pinned statuses", %{conn: conn, user: user, activity: %{id: activity_id}} do
787 {:ok, _} = CommonAPI.pin(activity_id, user)
789 assert [%{"id" => ^activity_id, "pinned" => true}] =
791 |> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
792 |> json_response_and_validate_schema(200)
796 test "blocking / unblocking a user" do
797 %{conn: conn} = oauth_access(["follow"])
798 other_user = insert(:user)
800 ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/block")
802 assert %{"id" => _id, "blocking" => true} = json_response_and_validate_schema(ret_conn, 200)
804 conn = post(conn, "/api/v1/accounts/#{other_user.id}/unblock")
806 assert %{"id" => _id, "blocking" => false} = json_response_and_validate_schema(conn, 200)
809 describe "create account by app" do
813 email: "lain@example.org",
814 password: "PlzDontHackLain",
818 [valid_params: valid_params]
821 setup do: clear_config([:instance, :account_activation_required])
823 test "Account registration via Application", %{conn: conn} do
826 |> put_req_header("content-type", "application/json")
827 |> post("/api/v1/apps", %{
828 client_name: "client_name",
829 redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
830 scopes: "read, write, follow"
834 "client_id" => client_id,
835 "client_secret" => client_secret,
837 "name" => "client_name",
838 "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
841 } = json_response_and_validate_schema(conn, 200)
844 post(conn, "/oauth/token", %{
845 grant_type: "client_credentials",
846 client_id: client_id,
847 client_secret: client_secret
850 assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
851 json_response(conn, 200)
854 token_from_db = Repo.get_by(Token, token: token)
857 assert scope == "read write follow"
861 |> put_req_header("content-type", "multipart/form-data")
862 |> put_req_header("authorization", "Bearer " <> token)
863 |> post("/api/v1/accounts", %{
865 email: "lain@example.org",
866 password: "PlzDontHackLain",
872 "access_token" => token,
873 "created_at" => _created_at,
875 "token_type" => "Bearer"
876 } = json_response_and_validate_schema(conn, 200)
878 token_from_db = Repo.get_by(Token, token: token)
880 token_from_db = Repo.preload(token_from_db, :user)
881 assert token_from_db.user
883 assert token_from_db.user.confirmation_pending
886 test "returns error when user already registred", %{conn: conn, valid_params: valid_params} do
887 _user = insert(:user, email: "lain@example.org")
888 app_token = insert(:oauth_token, user: nil)
892 |> put_req_header("authorization", "Bearer " <> app_token.token)
893 |> put_req_header("content-type", "application/json")
894 |> post("/api/v1/accounts", valid_params)
896 assert json_response_and_validate_schema(res, 400) == %{
897 "error" => "{\"email\":[\"has already been taken\"]}"
901 test "returns bad_request if missing required params", %{
903 valid_params: valid_params
905 app_token = insert(:oauth_token, user: nil)
909 |> put_req_header("authorization", "Bearer " <> app_token.token)
910 |> put_req_header("content-type", "application/json")
912 res = post(conn, "/api/v1/accounts", valid_params)
913 assert json_response_and_validate_schema(res, 200)
915 [{127, 0, 0, 1}, {127, 0, 0, 2}, {127, 0, 0, 3}, {127, 0, 0, 4}]
916 |> Stream.zip(Map.delete(valid_params, :email))
917 |> Enum.each(fn {ip, {attr, _}} ->
920 |> Map.put(:remote_ip, ip)
921 |> post("/api/v1/accounts", Map.delete(valid_params, attr))
922 |> json_response_and_validate_schema(400)
925 "error" => "Missing field: #{attr}.",
928 "message" => "Missing field: #{attr}",
929 "source" => %{"pointer" => "/#{attr}"},
930 "title" => "Invalid value"
937 setup do: clear_config([:instance, :account_activation_required])
939 test "returns bad_request if missing email params when :account_activation_required is enabled",
940 %{conn: conn, valid_params: valid_params} do
941 Pleroma.Config.put([:instance, :account_activation_required], true)
943 app_token = insert(:oauth_token, user: nil)
947 |> put_req_header("authorization", "Bearer " <> app_token.token)
948 |> put_req_header("content-type", "application/json")
952 |> Map.put(:remote_ip, {127, 0, 0, 5})
953 |> post("/api/v1/accounts", Map.delete(valid_params, :email))
955 assert json_response_and_validate_schema(res, 400) ==
956 %{"error" => "Missing parameter: email"}
960 |> Map.put(:remote_ip, {127, 0, 0, 6})
961 |> post("/api/v1/accounts", Map.put(valid_params, :email, ""))
963 assert json_response_and_validate_schema(res, 400) == %{
964 "error" => "{\"email\":[\"can't be blank\"]}"
968 test "allow registration without an email", %{conn: conn, valid_params: valid_params} do
969 app_token = insert(:oauth_token, user: nil)
970 conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
974 |> put_req_header("content-type", "application/json")
975 |> Map.put(:remote_ip, {127, 0, 0, 7})
976 |> post("/api/v1/accounts", Map.delete(valid_params, :email))
978 assert json_response_and_validate_schema(res, 200)
981 test "allow registration with an empty email", %{conn: conn, valid_params: valid_params} do
982 app_token = insert(:oauth_token, user: nil)
983 conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
987 |> put_req_header("content-type", "application/json")
988 |> Map.put(:remote_ip, {127, 0, 0, 8})
989 |> post("/api/v1/accounts", Map.put(valid_params, :email, ""))
991 assert json_response_and_validate_schema(res, 200)
994 test "returns forbidden if token is invalid", %{conn: conn, valid_params: valid_params} do
997 |> put_req_header("authorization", "Bearer " <> "invalid-token")
998 |> put_req_header("content-type", "multipart/form-data")
999 |> post("/api/v1/accounts", valid_params)
1001 assert json_response_and_validate_schema(res, 403) == %{"error" => "Invalid credentials"}
1004 test "registration from trusted app" do
1005 clear_config([Pleroma.Captcha, :enabled], true)
1006 app = insert(:oauth_app, trusted: true, scopes: ["read", "write", "follow", "push"])
1010 |> post("/oauth/token", %{
1011 "grant_type" => "client_credentials",
1012 "client_id" => app.client_id,
1013 "client_secret" => app.client_secret
1016 assert %{"access_token" => token, "token_type" => "Bearer"} = json_response(conn, 200)
1020 |> Plug.Conn.put_req_header("authorization", "Bearer " <> token)
1021 |> put_req_header("content-type", "multipart/form-data")
1022 |> post("/api/v1/accounts", %{
1023 nickname: "nickanme",
1025 email: "email@example.com",
1028 password: "some_password",
1029 confirm: "some_password"
1031 |> json_response_and_validate_schema(200)
1034 "access_token" => access_token,
1036 "scope" => ["read", "write", "follow", "push"],
1037 "token_type" => "Bearer"
1042 |> Plug.Conn.put_req_header("authorization", "Bearer " <> access_token)
1043 |> get("/api/v1/accounts/verify_credentials")
1044 |> json_response_and_validate_schema(200)
1049 "display_name" => "Lain",
1050 "follow_requests_count" => 0,
1051 "followers_count" => 0,
1052 "following_count" => 0,
1059 "actor_type" => "Person",
1060 "discoverable" => false,
1061 "no_rich_text" => false,
1064 "privacy" => "public",
1065 "sensitive" => false
1067 "statuses_count" => 0,
1068 "username" => "Lain"
1073 describe "create account by app / rate limit" do
1074 setup do: clear_config([:rate_limit, :app_account_creation], {10_000, 2})
1076 test "respects rate limit setting", %{conn: conn} do
1077 app_token = insert(:oauth_token, user: nil)
1081 |> put_req_header("authorization", "Bearer " <> app_token.token)
1082 |> Map.put(:remote_ip, {15, 15, 15, 15})
1083 |> put_req_header("content-type", "multipart/form-data")
1088 |> post("/api/v1/accounts", %{
1089 username: "#{i}lain",
1090 email: "#{i}lain@example.org",
1091 password: "PlzDontHackLain",
1096 "access_token" => token,
1097 "created_at" => _created_at,
1099 "token_type" => "Bearer"
1100 } = json_response_and_validate_schema(conn, 200)
1102 token_from_db = Repo.get_by(Token, token: token)
1103 assert token_from_db
1104 token_from_db = Repo.preload(token_from_db, :user)
1105 assert token_from_db.user
1107 assert token_from_db.user.confirmation_pending
1111 post(conn, "/api/v1/accounts", %{
1113 email: "6lain@example.org",
1114 password: "PlzDontHackLain",
1118 assert json_response_and_validate_schema(conn, :too_many_requests) == %{
1119 "error" => "Throttled"
1124 describe "create account with enabled captcha" do
1125 setup %{conn: conn} do
1126 app_token = insert(:oauth_token, user: nil)
1130 |> put_req_header("authorization", "Bearer " <> app_token.token)
1131 |> put_req_header("content-type", "multipart/form-data")
1136 setup do: clear_config([Pleroma.Captcha, :enabled], true)
1138 test "creates an account and returns 200 if captcha is valid", %{conn: conn} do
1139 %{token: token, answer_data: answer_data} = Pleroma.Captcha.new()
1143 email: "lain@example.org",
1144 password: "PlzDontHackLain",
1146 captcha_solution: Pleroma.Captcha.Mock.solution(),
1147 captcha_token: token,
1148 captcha_answer_data: answer_data
1152 "access_token" => access_token,
1154 "scope" => ["read"],
1155 "token_type" => "Bearer"
1158 |> post("/api/v1/accounts", params)
1159 |> json_response_and_validate_schema(:ok)
1161 assert Token |> Repo.get_by(token: access_token) |> Repo.preload(:user) |> Map.get(:user)
1163 Cachex.del(:used_captcha_cache, token)
1166 test "returns 400 if any captcha field is not provided", %{conn: conn} do
1167 captcha_fields = [:captcha_solution, :captcha_token, :captcha_answer_data]
1171 email: "lain@example.org",
1172 password: "PlzDontHackLain",
1174 captcha_solution: "xx",
1175 captcha_token: "xx",
1176 captcha_answer_data: "xx"
1179 for field <- captcha_fields do
1181 "error" => "{\"captcha\":[\"Invalid CAPTCHA (Missing parameter: #{field})\"]}"
1186 |> post("/api/v1/accounts", Map.delete(valid_params, field))
1187 |> json_response_and_validate_schema(:bad_request)
1191 test "returns an error if captcha is invalid", %{conn: conn} do
1194 email: "lain@example.org",
1195 password: "PlzDontHackLain",
1197 captcha_solution: "cofe",
1198 captcha_token: "cofe",
1199 captcha_answer_data: "cofe"
1202 assert %{"error" => "{\"captcha\":[\"Invalid answer data\"]}"} ==
1204 |> post("/api/v1/accounts", params)
1205 |> json_response_and_validate_schema(:bad_request)
1209 describe "GET /api/v1/accounts/:id/lists - account_lists" do
1210 test "returns lists to which the account belongs" do
1211 %{user: user, conn: conn} = oauth_access(["read:lists"])
1212 other_user = insert(:user)
1213 assert {:ok, %Pleroma.List{id: list_id} = list} = Pleroma.List.create("Test List", user)
1214 {:ok, %{following: _following}} = Pleroma.List.follow(list, other_user)
1216 assert [%{"id" => list_id, "title" => "Test List"}] =
1218 |> get("/api/v1/accounts/#{other_user.id}/lists")
1219 |> json_response_and_validate_schema(200)
1223 describe "verify_credentials" do
1224 test "verify_credentials" do
1225 %{user: user, conn: conn} = oauth_access(["read:accounts"])
1226 [notification | _] = insert_list(7, :notification, user: user)
1227 Pleroma.Notification.set_read_up_to(user, notification.id)
1228 conn = get(conn, "/api/v1/accounts/verify_credentials")
1230 response = json_response_and_validate_schema(conn, 200)
1232 assert %{"id" => id, "source" => %{"privacy" => "public"}} = response
1233 assert response["pleroma"]["chat_token"]
1234 assert response["pleroma"]["unread_notifications_count"] == 6
1235 assert id == to_string(user.id)
1238 test "verify_credentials default scope unlisted" do
1239 user = insert(:user, default_scope: "unlisted")
1240 %{conn: conn} = oauth_access(["read:accounts"], user: user)
1242 conn = get(conn, "/api/v1/accounts/verify_credentials")
1244 assert %{"id" => id, "source" => %{"privacy" => "unlisted"}} =
1245 json_response_and_validate_schema(conn, 200)
1247 assert id == to_string(user.id)
1250 test "locked accounts" do
1251 user = insert(:user, default_scope: "private")
1252 %{conn: conn} = oauth_access(["read:accounts"], user: user)
1254 conn = get(conn, "/api/v1/accounts/verify_credentials")
1256 assert %{"id" => id, "source" => %{"privacy" => "private"}} =
1257 json_response_and_validate_schema(conn, 200)
1259 assert id == to_string(user.id)
1263 describe "user relationships" do
1264 setup do: oauth_access(["read:follows"])
1266 test "returns the relationships for the current user", %{user: user, conn: conn} do
1267 %{id: other_user_id} = other_user = insert(:user)
1268 {:ok, _user} = User.follow(user, other_user)
1270 assert [%{"id" => ^other_user_id}] =
1272 |> get("/api/v1/accounts/relationships?id=#{other_user.id}")
1273 |> json_response_and_validate_schema(200)
1275 assert [%{"id" => ^other_user_id}] =
1277 |> get("/api/v1/accounts/relationships?id[]=#{other_user.id}")
1278 |> json_response_and_validate_schema(200)
1281 test "returns an empty list on a bad request", %{conn: conn} do
1282 conn = get(conn, "/api/v1/accounts/relationships", %{})
1284 assert [] = json_response_and_validate_schema(conn, 200)
1288 test "getting a list of mutes" do
1289 %{user: user, conn: conn} = oauth_access(["read:mutes"])
1290 other_user = insert(:user)
1292 {:ok, _user_relationships} = User.mute(user, other_user)
1294 conn = get(conn, "/api/v1/mutes")
1296 other_user_id = to_string(other_user.id)
1297 assert [%{"id" => ^other_user_id}] = json_response_and_validate_schema(conn, 200)
1300 test "getting a list of blocks" do
1301 %{user: user, conn: conn} = oauth_access(["read:blocks"])
1302 other_user = insert(:user)
1304 {:ok, _user_relationship} = User.block(user, other_user)
1308 |> assign(:user, user)
1309 |> get("/api/v1/blocks")
1311 other_user_id = to_string(other_user.id)
1312 assert [%{"id" => ^other_user_id}] = json_response_and_validate_schema(conn, 200)