git.squeep.com Git - akkoma/blob - test/web/mastodon_api/controllers/account_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.AccountControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   alias Pleroma.Config
   9   alias Pleroma.Repo
  10   alias Pleroma.User
  11   alias Pleroma.Web.ActivityPub.ActivityPub
  12   alias Pleroma.Web.ActivityPub.InternalFetchActor
  13   alias Pleroma.Web.CommonAPI
  14   alias Pleroma.Web.OAuth.Token
  15
  16   import Pleroma.Factory
  17
  18   describe "account fetching" do
  19     setup do: clear_config([:instance, :limit_to_local_content])
  20
  21     test "works by id" do
  22       user = insert(:user)
  23
  24       conn =
  25         build_conn()
  26         |> get("/api/v1/accounts/#{user.id}")
  27
  28       assert %{"id" => id} = json_response(conn, 200)
  29       assert id == to_string(user.id)
  30
  31       conn =
  32         build_conn()
  33         |> get("/api/v1/accounts/-1")
  34
  35       assert %{"error" => "Can't find user"} = json_response(conn, 404)
  36     end
  37
  38     test "works by nickname" do
  39       user = insert(:user)
  40
  41       conn =
  42         build_conn()
  43         |> get("/api/v1/accounts/#{user.nickname}")
  44
  45       assert %{"id" => id} = json_response(conn, 200)
  46       assert id == user.id
  47     end
  48
  49     test "works by nickname for remote users" do
  50       Config.put([:instance, :limit_to_local_content], false)
  51       user = insert(:user, nickname: "user@example.com", local: false)
  52
  53       conn =
  54         build_conn()
  55         |> get("/api/v1/accounts/#{user.nickname}")
  56
  57       assert %{"id" => id} = json_response(conn, 200)
  58       assert id == user.id
  59     end
  60
  61     test "respects limit_to_local_content == :all for remote user nicknames" do
  62       Config.put([:instance, :limit_to_local_content], :all)
  63
  64       user = insert(:user, nickname: "user@example.com", local: false)
  65
  66       conn =
  67         build_conn()
  68         |> get("/api/v1/accounts/#{user.nickname}")
  69
  70       assert json_response(conn, 404)
  71     end
  72
  73     test "respects limit_to_local_content == :unauthenticated for remote user nicknames" do
  74       Config.put([:instance, :limit_to_local_content], :unauthenticated)
  75
  76       user = insert(:user, nickname: "user@example.com", local: false)
  77       reading_user = insert(:user)
  78
  79       conn =
  80         build_conn()
  81         |> get("/api/v1/accounts/#{user.nickname}")
  82
  83       assert json_response(conn, 404)
  84
  85       conn =
  86         build_conn()
  87         |> assign(:user, reading_user)
  88         |> assign(:token, insert(:oauth_token, user: reading_user, scopes: ["read:accounts"]))
  89         |> get("/api/v1/accounts/#{user.nickname}")
  90
  91       assert %{"id" => id} = json_response(conn, 200)
  92       assert id == user.id
  93     end
  94
  95     test "accounts fetches correct account for nicknames beginning with numbers", %{conn: conn} do
  96       # Need to set an old-style integer ID to reproduce the problem
  97       # (these are no longer assigned to new accounts but were preserved
  98       # for existing accounts during the migration to flakeIDs)
  99       user_one = insert(:user, %{id: 1212})
 100       user_two = insert(:user, %{nickname: "#{user_one.id}garbage"})
 101
 102       resp_one =
 103         conn
 104         |> get("/api/v1/accounts/#{user_one.id}")
 105
 106       resp_two =
 107         conn
 108         |> get("/api/v1/accounts/#{user_two.nickname}")
 109
 110       resp_three =
 111         conn
 112         |> get("/api/v1/accounts/#{user_two.id}")
 113
 114       acc_one = json_response(resp_one, 200)
 115       acc_two = json_response(resp_two, 200)
 116       acc_three = json_response(resp_three, 200)
 117       refute acc_one == acc_two
 118       assert acc_two == acc_three
 119     end
 120
 121     test "returns 404 when user is invisible", %{conn: conn} do
 122       user = insert(:user, %{invisible: true})
 123
 124       resp =
 125         conn
 126         |> get("/api/v1/accounts/#{user.nickname}")
 127         |> json_response(404)
 128
 129       assert %{"error" => "Can't find user"} = resp
 130     end
 131
 132     test "returns 404 for internal.fetch actor", %{conn: conn} do
 133       %User{nickname: "internal.fetch"} = InternalFetchActor.get_actor()
 134
 135       resp =
 136         conn
 137         |> get("/api/v1/accounts/internal.fetch")
 138         |> json_response(404)
 139
 140       assert %{"error" => "Can't find user"} = resp
 141     end
 142   end
 143
 144   defp local_and_remote_users do
 145     local = insert(:user)
 146     remote = insert(:user, local: false)
 147     {:ok, local: local, remote: remote}
 148   end
 149
 150   describe "user fetching with restrict unauthenticated profiles for local and remote" do
 151     setup do: local_and_remote_users()
 152
 153     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 154
 155     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 156
 157     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 158       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 159
 160       assert json_response(res_conn, :not_found) == %{
 161                "error" => "Can't find user"
 162              }
 163
 164       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 165
 166       assert json_response(res_conn, :not_found) == %{
 167                "error" => "Can't find user"
 168              }
 169     end
 170
 171     test "if user is authenticated", %{local: local, remote: remote} do
 172       %{conn: conn} = oauth_access(["read"])
 173
 174       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 175       assert %{"id" => _} = json_response(res_conn, 200)
 176
 177       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 178       assert %{"id" => _} = json_response(res_conn, 200)
 179     end
 180   end
 181
 182   describe "user fetching with restrict unauthenticated profiles for local" do
 183     setup do: local_and_remote_users()
 184
 185     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 186
 187     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 188       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 189
 190       assert json_response(res_conn, :not_found) == %{
 191                "error" => "Can't find user"
 192              }
 193
 194       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 195       assert %{"id" => _} = json_response(res_conn, 200)
 196     end
 197
 198     test "if user is authenticated", %{local: local, remote: remote} do
 199       %{conn: conn} = oauth_access(["read"])
 200
 201       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 202       assert %{"id" => _} = json_response(res_conn, 200)
 203
 204       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 205       assert %{"id" => _} = json_response(res_conn, 200)
 206     end
 207   end
 208
 209   describe "user fetching with restrict unauthenticated profiles for remote" do
 210     setup do: local_and_remote_users()
 211
 212     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 213
 214     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 215       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 216       assert %{"id" => _} = json_response(res_conn, 200)
 217
 218       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 219
 220       assert json_response(res_conn, :not_found) == %{
 221                "error" => "Can't find user"
 222              }
 223     end
 224
 225     test "if user is authenticated", %{local: local, remote: remote} do
 226       %{conn: conn} = oauth_access(["read"])
 227
 228       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 229       assert %{"id" => _} = json_response(res_conn, 200)
 230
 231       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 232       assert %{"id" => _} = json_response(res_conn, 200)
 233     end
 234   end
 235
 236   describe "user timelines" do
 237     setup do: oauth_access(["read:statuses"])
 238
 239     test "respects blocks", %{user: user_one, conn: conn} do
 240       user_two = insert(:user)
 241       user_three = insert(:user)
 242
 243       User.block(user_one, user_two)
 244
 245       {:ok, activity} = CommonAPI.post(user_two, %{"status" => "User one sux0rz"})
 246       {:ok, repeat, _} = CommonAPI.repeat(activity.id, user_three)
 247
 248       resp = get(conn, "/api/v1/accounts/#{user_two.id}/statuses")
 249
 250       assert [%{"id" => id}] = json_response(resp, 200)
 251       assert id == activity.id
 252
 253       # Even a blocked user will deliver the full user timeline, there would be
 254       #   no point in looking at a blocked users timeline otherwise
 255       resp = get(conn, "/api/v1/accounts/#{user_two.id}/statuses")
 256
 257       assert [%{"id" => id}] = json_response(resp, 200)
 258       assert id == activity.id
 259
 260       # Third user's timeline includes the repeat when viewed by unauthenticated user
 261       resp = get(build_conn(), "/api/v1/accounts/#{user_three.id}/statuses")
 262       assert [%{"id" => id}] = json_response(resp, 200)
 263       assert id == repeat.id
 264
 265       # When viewing a third user's timeline, the blocked users' statuses will NOT be shown
 266       resp = get(conn, "/api/v1/accounts/#{user_three.id}/statuses")
 267
 268       assert [] = json_response(resp, 200)
 269     end
 270
 271     test "gets users statuses", %{conn: conn} do
 272       user_one = insert(:user)
 273       user_two = insert(:user)
 274       user_three = insert(:user)
 275
 276       {:ok, _user_three} = User.follow(user_three, user_one)
 277
 278       {:ok, activity} = CommonAPI.post(user_one, %{"status" => "HI!!!"})
 279
 280       {:ok, direct_activity} =
 281         CommonAPI.post(user_one, %{
 282           "status" => "Hi, @#{user_two.nickname}.",
 283           "visibility" => "direct"
 284         })
 285
 286       {:ok, private_activity} =
 287         CommonAPI.post(user_one, %{"status" => "private", "visibility" => "private"})
 288
 289       resp = get(conn, "/api/v1/accounts/#{user_one.id}/statuses")
 290
 291       assert [%{"id" => id}] = json_response(resp, 200)
 292       assert id == to_string(activity.id)
 293
 294       resp =
 295         conn
 296         |> assign(:user, user_two)
 297         |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
 298         |> get("/api/v1/accounts/#{user_one.id}/statuses")
 299
 300       assert [%{"id" => id_one}, %{"id" => id_two}] = json_response(resp, 200)
 301       assert id_one == to_string(direct_activity.id)
 302       assert id_two == to_string(activity.id)
 303
 304       resp =
 305         conn
 306         |> assign(:user, user_three)
 307         |> assign(:token, insert(:oauth_token, user: user_three, scopes: ["read:statuses"]))
 308         |> get("/api/v1/accounts/#{user_one.id}/statuses")
 309
 310       assert [%{"id" => id_one}, %{"id" => id_two}] = json_response(resp, 200)
 311       assert id_one == to_string(private_activity.id)
 312       assert id_two == to_string(activity.id)
 313     end
 314
 315     test "unimplemented pinned statuses feature", %{conn: conn} do
 316       note = insert(:note_activity)
 317       user = User.get_cached_by_ap_id(note.data["actor"])
 318
 319       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?pinned=true")
 320
 321       assert json_response(conn, 200) == []
 322     end
 323
 324     test "gets an users media", %{conn: conn} do
 325       note = insert(:note_activity)
 326       user = User.get_cached_by_ap_id(note.data["actor"])
 327
 328       file = %Plug.Upload{
 329         content_type: "image/jpg",
 330         path: Path.absname("test/fixtures/image.jpg"),
 331         filename: "an_image.jpg"
 332       }
 333
 334       {:ok, %{id: media_id}} = ActivityPub.upload(file, actor: user.ap_id)
 335
 336       {:ok, image_post} = CommonAPI.post(user, %{"status" => "cofe", "media_ids" => [media_id]})
 337
 338       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses", %{"only_media" => "true"})
 339
 340       assert [%{"id" => id}] = json_response(conn, 200)
 341       assert id == to_string(image_post.id)
 342
 343       conn = get(build_conn(), "/api/v1/accounts/#{user.id}/statuses", %{"only_media" => "1"})
 344
 345       assert [%{"id" => id}] = json_response(conn, 200)
 346       assert id == to_string(image_post.id)
 347     end
 348
 349     test "gets a user's statuses without reblogs", %{user: user, conn: conn} do
 350       {:ok, post} = CommonAPI.post(user, %{"status" => "HI!!!"})
 351       {:ok, _, _} = CommonAPI.repeat(post.id, user)
 352
 353       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses", %{"exclude_reblogs" => "true"})
 354
 355       assert [%{"id" => id}] = json_response(conn, 200)
 356       assert id == to_string(post.id)
 357
 358       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses", %{"exclude_reblogs" => "1"})
 359
 360       assert [%{"id" => id}] = json_response(conn, 200)
 361       assert id == to_string(post.id)
 362     end
 363
 364     test "filters user's statuses by a hashtag", %{user: user, conn: conn} do
 365       {:ok, post} = CommonAPI.post(user, %{"status" => "#hashtag"})
 366       {:ok, _post} = CommonAPI.post(user, %{"status" => "hashtag"})
 367
 368       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses", %{"tagged" => "hashtag"})
 369
 370       assert [%{"id" => id}] = json_response(conn, 200)
 371       assert id == to_string(post.id)
 372     end
 373
 374     test "the user views their own timelines and excludes direct messages", %{
 375       user: user,
 376       conn: conn
 377     } do
 378       {:ok, public_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "public"})
 379       {:ok, _direct_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "direct"})
 380
 381       conn =
 382         get(conn, "/api/v1/accounts/#{user.id}/statuses", %{"exclude_visibilities" => ["direct"]})
 383
 384       assert [%{"id" => id}] = json_response(conn, 200)
 385       assert id == to_string(public_activity.id)
 386     end
 387   end
 388
 389   defp local_and_remote_activities(%{local: local, remote: remote}) do
 390     insert(:note_activity, user: local)
 391     insert(:note_activity, user: remote, local: false)
 392
 393     :ok
 394   end
 395
 396   describe "statuses with restrict unauthenticated profiles for local and remote" do
 397     setup do: local_and_remote_users()
 398     setup :local_and_remote_activities
 399
 400     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 401
 402     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 403
 404     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 405       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 406
 407       assert json_response(res_conn, :not_found) == %{
 408                "error" => "Can't find user"
 409              }
 410
 411       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 412
 413       assert json_response(res_conn, :not_found) == %{
 414                "error" => "Can't find user"
 415              }
 416     end
 417
 418     test "if user is authenticated", %{local: local, remote: remote} do
 419       %{conn: conn} = oauth_access(["read"])
 420
 421       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 422       assert length(json_response(res_conn, 200)) == 1
 423
 424       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 425       assert length(json_response(res_conn, 200)) == 1
 426     end
 427   end
 428
 429   describe "statuses with restrict unauthenticated profiles for local" do
 430     setup do: local_and_remote_users()
 431     setup :local_and_remote_activities
 432
 433     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 434
 435     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 436       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 437
 438       assert json_response(res_conn, :not_found) == %{
 439                "error" => "Can't find user"
 440              }
 441
 442       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 443       assert length(json_response(res_conn, 200)) == 1
 444     end
 445
 446     test "if user is authenticated", %{local: local, remote: remote} do
 447       %{conn: conn} = oauth_access(["read"])
 448
 449       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 450       assert length(json_response(res_conn, 200)) == 1
 451
 452       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 453       assert length(json_response(res_conn, 200)) == 1
 454     end
 455   end
 456
 457   describe "statuses with restrict unauthenticated profiles for remote" do
 458     setup do: local_and_remote_users()
 459     setup :local_and_remote_activities
 460
 461     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 462
 463     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 464       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 465       assert length(json_response(res_conn, 200)) == 1
 466
 467       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 468
 469       assert json_response(res_conn, :not_found) == %{
 470                "error" => "Can't find user"
 471              }
 472     end
 473
 474     test "if user is authenticated", %{local: local, remote: remote} do
 475       %{conn: conn} = oauth_access(["read"])
 476
 477       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 478       assert length(json_response(res_conn, 200)) == 1
 479
 480       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 481       assert length(json_response(res_conn, 200)) == 1
 482     end
 483   end
 484
 485   describe "followers" do
 486     setup do: oauth_access(["read:accounts"])
 487
 488     test "getting followers", %{user: user, conn: conn} do
 489       other_user = insert(:user)
 490       {:ok, user} = User.follow(user, other_user)
 491
 492       conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")
 493
 494       assert [%{"id" => id}] = json_response(conn, 200)
 495       assert id == to_string(user.id)
 496     end
 497
 498     test "getting followers, hide_followers", %{user: user, conn: conn} do
 499       other_user = insert(:user, hide_followers: true)
 500       {:ok, _user} = User.follow(user, other_user)
 501
 502       conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")
 503
 504       assert [] == json_response(conn, 200)
 505     end
 506
 507     test "getting followers, hide_followers, same user requesting" do
 508       user = insert(:user)
 509       other_user = insert(:user, hide_followers: true)
 510       {:ok, _user} = User.follow(user, other_user)
 511
 512       conn =
 513         build_conn()
 514         |> assign(:user, other_user)
 515         |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
 516         |> get("/api/v1/accounts/#{other_user.id}/followers")
 517
 518       refute [] == json_response(conn, 200)
 519     end
 520
 521     test "getting followers, pagination", %{user: user, conn: conn} do
 522       follower1 = insert(:user)
 523       follower2 = insert(:user)
 524       follower3 = insert(:user)
 525       {:ok, _} = User.follow(follower1, user)
 526       {:ok, _} = User.follow(follower2, user)
 527       {:ok, _} = User.follow(follower3, user)
 528
 529       res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?since_id=#{follower1.id}")
 530
 531       assert [%{"id" => id3}, %{"id" => id2}] = json_response(res_conn, 200)
 532       assert id3 == follower3.id
 533       assert id2 == follower2.id
 534
 535       res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?max_id=#{follower3.id}")
 536
 537       assert [%{"id" => id2}, %{"id" => id1}] = json_response(res_conn, 200)
 538       assert id2 == follower2.id
 539       assert id1 == follower1.id
 540
 541       res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?limit=1&max_id=#{follower3.id}")
 542
 543       assert [%{"id" => id2}] = json_response(res_conn, 200)
 544       assert id2 == follower2.id
 545
 546       assert [link_header] = get_resp_header(res_conn, "link")
 547       assert link_header =~ ~r/min_id=#{follower2.id}/
 548       assert link_header =~ ~r/max_id=#{follower2.id}/
 549     end
 550   end
 551
 552   describe "following" do
 553     setup do: oauth_access(["read:accounts"])
 554
 555     test "getting following", %{user: user, conn: conn} do
 556       other_user = insert(:user)
 557       {:ok, user} = User.follow(user, other_user)
 558
 559       conn = get(conn, "/api/v1/accounts/#{user.id}/following")
 560
 561       assert [%{"id" => id}] = json_response(conn, 200)
 562       assert id == to_string(other_user.id)
 563     end
 564
 565     test "getting following, hide_follows, other user requesting" do
 566       user = insert(:user, hide_follows: true)
 567       other_user = insert(:user)
 568       {:ok, user} = User.follow(user, other_user)
 569
 570       conn =
 571         build_conn()
 572         |> assign(:user, other_user)
 573         |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
 574         |> get("/api/v1/accounts/#{user.id}/following")
 575
 576       assert [] == json_response(conn, 200)
 577     end
 578
 579     test "getting following, hide_follows, same user requesting" do
 580       user = insert(:user, hide_follows: true)
 581       other_user = insert(:user)
 582       {:ok, user} = User.follow(user, other_user)
 583
 584       conn =
 585         build_conn()
 586         |> assign(:user, user)
 587         |> assign(:token, insert(:oauth_token, user: user, scopes: ["read:accounts"]))
 588         |> get("/api/v1/accounts/#{user.id}/following")
 589
 590       refute [] == json_response(conn, 200)
 591     end
 592
 593     test "getting following, pagination", %{user: user, conn: conn} do
 594       following1 = insert(:user)
 595       following2 = insert(:user)
 596       following3 = insert(:user)
 597       {:ok, _} = User.follow(user, following1)
 598       {:ok, _} = User.follow(user, following2)
 599       {:ok, _} = User.follow(user, following3)
 600
 601       res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?since_id=#{following1.id}")
 602
 603       assert [%{"id" => id3}, %{"id" => id2}] = json_response(res_conn, 200)
 604       assert id3 == following3.id
 605       assert id2 == following2.id
 606
 607       res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?max_id=#{following3.id}")
 608
 609       assert [%{"id" => id2}, %{"id" => id1}] = json_response(res_conn, 200)
 610       assert id2 == following2.id
 611       assert id1 == following1.id
 612
 613       res_conn =
 614         get(conn, "/api/v1/accounts/#{user.id}/following?limit=1&max_id=#{following3.id}")
 615
 616       assert [%{"id" => id2}] = json_response(res_conn, 200)
 617       assert id2 == following2.id
 618
 619       assert [link_header] = get_resp_header(res_conn, "link")
 620       assert link_header =~ ~r/min_id=#{following2.id}/
 621       assert link_header =~ ~r/max_id=#{following2.id}/
 622     end
 623   end
 624
 625   describe "follow/unfollow" do
 626     setup do: oauth_access(["follow"])
 627
 628     test "following / unfollowing a user", %{conn: conn} do
 629       other_user = insert(:user)
 630
 631       ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/follow")
 632
 633       assert %{"id" => _id, "following" => true} = json_response(ret_conn, 200)
 634
 635       ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/unfollow")
 636
 637       assert %{"id" => _id, "following" => false} = json_response(ret_conn, 200)
 638
 639       conn = post(conn, "/api/v1/follows", %{"uri" => other_user.nickname})
 640
 641       assert %{"id" => id} = json_response(conn, 200)
 642       assert id == to_string(other_user.id)
 643     end
 644
 645     test "cancelling follow request", %{conn: conn} do
 646       %{id: other_user_id} = insert(:user, %{locked: true})
 647
 648       assert %{"id" => ^other_user_id, "following" => false, "requested" => true} =
 649                conn |> post("/api/v1/accounts/#{other_user_id}/follow") |> json_response(:ok)
 650
 651       assert %{"id" => ^other_user_id, "following" => false, "requested" => false} =
 652                conn |> post("/api/v1/accounts/#{other_user_id}/unfollow") |> json_response(:ok)
 653     end
 654
 655     test "following without reblogs" do
 656       %{conn: conn} = oauth_access(["follow", "read:statuses"])
 657       followed = insert(:user)
 658       other_user = insert(:user)
 659
 660       ret_conn = post(conn, "/api/v1/accounts/#{followed.id}/follow?reblogs=false")
 661
 662       assert %{"showing_reblogs" => false} = json_response(ret_conn, 200)
 663
 664       {:ok, activity} = CommonAPI.post(other_user, %{"status" => "hey"})
 665       {:ok, reblog, _} = CommonAPI.repeat(activity.id, followed)
 666
 667       ret_conn = get(conn, "/api/v1/timelines/home")
 668
 669       assert [] == json_response(ret_conn, 200)
 670
 671       ret_conn = post(conn, "/api/v1/accounts/#{followed.id}/follow?reblogs=true")
 672
 673       assert %{"showing_reblogs" => true} = json_response(ret_conn, 200)
 674
 675       conn = get(conn, "/api/v1/timelines/home")
 676
 677       expected_activity_id = reblog.id
 678       assert [%{"id" => ^expected_activity_id}] = json_response(conn, 200)
 679     end
 680
 681     test "following / unfollowing errors", %{user: user, conn: conn} do
 682       # self follow
 683       conn_res = post(conn, "/api/v1/accounts/#{user.id}/follow")
 684       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 685
 686       # self unfollow
 687       user = User.get_cached_by_id(user.id)
 688       conn_res = post(conn, "/api/v1/accounts/#{user.id}/unfollow")
 689       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 690
 691       # self follow via uri
 692       user = User.get_cached_by_id(user.id)
 693       conn_res = post(conn, "/api/v1/follows", %{"uri" => user.nickname})
 694       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 695
 696       # follow non existing user
 697       conn_res = post(conn, "/api/v1/accounts/doesntexist/follow")
 698       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 699
 700       # follow non existing user via uri
 701       conn_res = post(conn, "/api/v1/follows", %{"uri" => "doesntexist"})
 702       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 703
 704       # unfollow non existing user
 705       conn_res = post(conn, "/api/v1/accounts/doesntexist/unfollow")
 706       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 707     end
 708   end
 709
 710   describe "mute/unmute" do
 711     setup do: oauth_access(["write:mutes"])
 712
 713     test "with notifications", %{conn: conn} do
 714       other_user = insert(:user)
 715
 716       ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/mute")
 717
 718       response = json_response(ret_conn, 200)
 719
 720       assert %{"id" => _id, "muting" => true, "muting_notifications" => true} = response
 721
 722       conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")
 723
 724       response = json_response(conn, 200)
 725       assert %{"id" => _id, "muting" => false, "muting_notifications" => false} = response
 726     end
 727
 728     test "without notifications", %{conn: conn} do
 729       other_user = insert(:user)
 730
 731       ret_conn =
 732         post(conn, "/api/v1/accounts/#{other_user.id}/mute", %{"notifications" => "false"})
 733
 734       response = json_response(ret_conn, 200)
 735
 736       assert %{"id" => _id, "muting" => true, "muting_notifications" => false} = response
 737
 738       conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")
 739
 740       response = json_response(conn, 200)
 741       assert %{"id" => _id, "muting" => false, "muting_notifications" => false} = response
 742     end
 743   end
 744
 745   describe "pinned statuses" do
 746     setup do
 747       user = insert(:user)
 748       {:ok, activity} = CommonAPI.post(user, %{"status" => "HI!!!"})
 749       %{conn: conn} = oauth_access(["read:statuses"], user: user)
 750
 751       [conn: conn, user: user, activity: activity]
 752     end
 753
 754     test "returns pinned statuses", %{conn: conn, user: user, activity: activity} do
 755       {:ok, _} = CommonAPI.pin(activity.id, user)
 756
 757       result =
 758         conn
 759         |> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
 760         |> json_response(200)
 761
 762       id_str = to_string(activity.id)
 763
 764       assert [%{"id" => ^id_str, "pinned" => true}] = result
 765     end
 766   end
 767
 768   test "blocking / unblocking a user" do
 769     %{conn: conn} = oauth_access(["follow"])
 770     other_user = insert(:user)
 771
 772     ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/block")
 773
 774     assert %{"id" => _id, "blocking" => true} = json_response(ret_conn, 200)
 775
 776     conn = post(conn, "/api/v1/accounts/#{other_user.id}/unblock")
 777
 778     assert %{"id" => _id, "blocking" => false} = json_response(conn, 200)
 779   end
 780
 781   describe "create account by app" do
 782     setup do
 783       valid_params = %{
 784         username: "lain",
 785         email: "lain@example.org",
 786         password: "PlzDontHackLain",
 787         agreement: true
 788       }
 789
 790       [valid_params: valid_params]
 791     end
 792
 793     setup do: clear_config([:instance, :account_activation_required])
 794
 795     test "Account registration via Application", %{conn: conn} do
 796       conn =
 797         conn
 798         |> put_req_header("content-type", "application/json")
 799         |> post("/api/v1/apps", %{
 800           client_name: "client_name",
 801           redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
 802           scopes: "read, write, follow"
 803         })
 804
 805       %{
 806         "client_id" => client_id,
 807         "client_secret" => client_secret,
 808         "id" => _,
 809         "name" => "client_name",
 810         "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
 811         "vapid_key" => _,
 812         "website" => nil
 813       } = json_response(conn, 200)
 814
 815       conn =
 816         post(conn, "/oauth/token", %{
 817           grant_type: "client_credentials",
 818           client_id: client_id,
 819           client_secret: client_secret
 820         })
 821
 822       assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
 823                json_response(conn, 200)
 824
 825       assert token
 826       token_from_db = Repo.get_by(Token, token: token)
 827       assert token_from_db
 828       assert refresh
 829       assert scope == "read write follow"
 830
 831       conn =
 832         build_conn()
 833         |> put_req_header("authorization", "Bearer " <> token)
 834         |> post("/api/v1/accounts", %{
 835           username: "lain",
 836           email: "lain@example.org",
 837           password: "PlzDontHackLain",
 838           bio: "Test Bio",
 839           agreement: true
 840         })
 841
 842       %{
 843         "access_token" => token,
 844         "created_at" => _created_at,
 845         "scope" => _scope,
 846         "token_type" => "Bearer"
 847       } = json_response(conn, 200)
 848
 849       token_from_db = Repo.get_by(Token, token: token)
 850       assert token_from_db
 851       token_from_db = Repo.preload(token_from_db, :user)
 852       assert token_from_db.user
 853
 854       assert token_from_db.user.confirmation_pending
 855     end
 856
 857     test "returns error when user already registred", %{conn: conn, valid_params: valid_params} do
 858       _user = insert(:user, email: "lain@example.org")
 859       app_token = insert(:oauth_token, user: nil)
 860
 861       conn =
 862         conn
 863         |> put_req_header("authorization", "Bearer " <> app_token.token)
 864
 865       res = post(conn, "/api/v1/accounts", valid_params)
 866       assert json_response(res, 400) == %{"error" => "{\"email\":[\"has already been taken\"]}"}
 867     end
 868
 869     test "returns bad_request if missing required params", %{
 870       conn: conn,
 871       valid_params: valid_params
 872     } do
 873       app_token = insert(:oauth_token, user: nil)
 874
 875       conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
 876
 877       res = post(conn, "/api/v1/accounts", valid_params)
 878       assert json_response(res, 200)
 879
 880       [{127, 0, 0, 1}, {127, 0, 0, 2}, {127, 0, 0, 3}, {127, 0, 0, 4}]
 881       |> Stream.zip(Map.delete(valid_params, :email))
 882       |> Enum.each(fn {ip, {attr, _}} ->
 883         res =
 884           conn
 885           |> Map.put(:remote_ip, ip)
 886           |> post("/api/v1/accounts", Map.delete(valid_params, attr))
 887           |> json_response(400)
 888
 889         assert res == %{"error" => "Missing parameters"}
 890       end)
 891     end
 892
 893     setup do: clear_config([:instance, :account_activation_required])
 894
 895     test "returns bad_request if missing email params when :account_activation_required is enabled",
 896          %{conn: conn, valid_params: valid_params} do
 897       Pleroma.Config.put([:instance, :account_activation_required], true)
 898
 899       app_token = insert(:oauth_token, user: nil)
 900       conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
 901
 902       res =
 903         conn
 904         |> Map.put(:remote_ip, {127, 0, 0, 5})
 905         |> post("/api/v1/accounts", Map.delete(valid_params, :email))
 906
 907       assert json_response(res, 400) == %{"error" => "Missing parameters"}
 908
 909       res =
 910         conn
 911         |> Map.put(:remote_ip, {127, 0, 0, 6})
 912         |> post("/api/v1/accounts", Map.put(valid_params, :email, ""))
 913
 914       assert json_response(res, 400) == %{"error" => "{\"email\":[\"can't be blank\"]}"}
 915     end
 916
 917     test "allow registration without an email", %{conn: conn, valid_params: valid_params} do
 918       app_token = insert(:oauth_token, user: nil)
 919       conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
 920
 921       res =
 922         conn
 923         |> Map.put(:remote_ip, {127, 0, 0, 7})
 924         |> post("/api/v1/accounts", Map.delete(valid_params, :email))
 925
 926       assert json_response(res, 200)
 927     end
 928
 929     test "allow registration with an empty email", %{conn: conn, valid_params: valid_params} do
 930       app_token = insert(:oauth_token, user: nil)
 931       conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
 932
 933       res =
 934         conn
 935         |> Map.put(:remote_ip, {127, 0, 0, 8})
 936         |> post("/api/v1/accounts", Map.put(valid_params, :email, ""))
 937
 938       assert json_response(res, 200)
 939     end
 940
 941     test "returns forbidden if token is invalid", %{conn: conn, valid_params: valid_params} do
 942       conn = put_req_header(conn, "authorization", "Bearer " <> "invalid-token")
 943
 944       res = post(conn, "/api/v1/accounts", valid_params)
 945       assert json_response(res, 403) == %{"error" => "Invalid credentials"}
 946     end
 947
 948     test "registration from trusted app" do
 949       clear_config([Pleroma.Captcha, :enabled], true)
 950       app = insert(:oauth_app, trusted: true, scopes: ["read", "write", "follow", "push"])
 951
 952       conn =
 953         build_conn()
 954         |> post("/oauth/token", %{
 955           "grant_type" => "client_credentials",
 956           "client_id" => app.client_id,
 957           "client_secret" => app.client_secret
 958         })
 959
 960       assert %{"access_token" => token, "token_type" => "Bearer"} = json_response(conn, 200)
 961
 962       response =
 963         build_conn()
 964         |> Plug.Conn.put_req_header("authorization", "Bearer " <> token)
 965         |> post("/api/v1/accounts", %{
 966           nickname: "nickanme",
 967           agreement: true,
 968           email: "email@example.com",
 969           fullname: "Lain",
 970           username: "Lain",
 971           password: "some_password",
 972           confirm: "some_password"
 973         })
 974         |> json_response(200)
 975
 976       assert %{
 977                "access_token" => access_token,
 978                "created_at" => _,
 979                "scope" => ["read", "write", "follow", "push"],
 980                "token_type" => "Bearer"
 981              } = response
 982
 983       response =
 984         build_conn()
 985         |> Plug.Conn.put_req_header("authorization", "Bearer " <> access_token)
 986         |> get("/api/v1/accounts/verify_credentials")
 987         |> json_response(200)
 988
 989       assert %{
 990                "acct" => "Lain",
 991                "bot" => false,
 992                "display_name" => "Lain",
 993                "follow_requests_count" => 0,
 994                "followers_count" => 0,
 995                "following_count" => 0,
 996                "locked" => false,
 997                "note" => "",
 998                "source" => %{
 999                  "fields" => [],
1000                  "note" => "",
1001                  "pleroma" => %{
1002                    "actor_type" => "Person",
1003                    "discoverable" => false,
1004                    "no_rich_text" => false,
1005                    "show_role" => true
1006                  },
1007                  "privacy" => "public",
1008                  "sensitive" => false
1009                },
1010                "statuses_count" => 0,
1011                "username" => "Lain"
1012              } = response
1013     end
1014   end
1015
1016   describe "create account by app / rate limit" do
1017     setup do: clear_config([:rate_limit, :app_account_creation], {10_000, 2})
1018
1019     test "respects rate limit setting", %{conn: conn} do
1020       app_token = insert(:oauth_token, user: nil)
1021
1022       conn =
1023         conn
1024         |> put_req_header("authorization", "Bearer " <> app_token.token)
1025         |> Map.put(:remote_ip, {15, 15, 15, 15})
1026
1027       for i <- 1..2 do
1028         conn =
1029           post(conn, "/api/v1/accounts", %{
1030             username: "#{i}lain",
1031             email: "#{i}lain@example.org",
1032             password: "PlzDontHackLain",
1033             agreement: true
1034           })
1035
1036         %{
1037           "access_token" => token,
1038           "created_at" => _created_at,
1039           "scope" => _scope,
1040           "token_type" => "Bearer"
1041         } = json_response(conn, 200)
1042
1043         token_from_db = Repo.get_by(Token, token: token)
1044         assert token_from_db
1045         token_from_db = Repo.preload(token_from_db, :user)
1046         assert token_from_db.user
1047
1048         assert token_from_db.user.confirmation_pending
1049       end
1050
1051       conn =
1052         post(conn, "/api/v1/accounts", %{
1053           username: "6lain",
1054           email: "6lain@example.org",
1055           password: "PlzDontHackLain",
1056           agreement: true
1057         })
1058
1059       assert json_response(conn, :too_many_requests) == %{"error" => "Throttled"}
1060     end
1061   end
1062
1063   describe "GET /api/v1/accounts/:id/lists - account_lists" do
1064     test "returns lists to which the account belongs" do
1065       %{user: user, conn: conn} = oauth_access(["read:lists"])
1066       other_user = insert(:user)
1067       assert {:ok, %Pleroma.List{} = list} = Pleroma.List.create("Test List", user)
1068       {:ok, %{following: _following}} = Pleroma.List.follow(list, other_user)
1069
1070       res =
1071         conn
1072         |> get("/api/v1/accounts/#{other_user.id}/lists")
1073         |> json_response(200)
1074
1075       assert res == [%{"id" => to_string(list.id), "title" => "Test List"}]
1076     end
1077   end
1078
1079   describe "verify_credentials" do
1080     test "verify_credentials" do
1081       %{user: user, conn: conn} = oauth_access(["read:accounts"])
1082       conn = get(conn, "/api/v1/accounts/verify_credentials")
1083
1084       response = json_response(conn, 200)
1085
1086       assert %{"id" => id, "source" => %{"privacy" => "public"}} = response
1087       assert response["pleroma"]["chat_token"]
1088       assert id == to_string(user.id)
1089     end
1090
1091     test "verify_credentials default scope unlisted" do
1092       user = insert(:user, default_scope: "unlisted")
1093       %{conn: conn} = oauth_access(["read:accounts"], user: user)
1094
1095       conn = get(conn, "/api/v1/accounts/verify_credentials")
1096
1097       assert %{"id" => id, "source" => %{"privacy" => "unlisted"}} = json_response(conn, 200)
1098       assert id == to_string(user.id)
1099     end
1100
1101     test "locked accounts" do
1102       user = insert(:user, default_scope: "private")
1103       %{conn: conn} = oauth_access(["read:accounts"], user: user)
1104
1105       conn = get(conn, "/api/v1/accounts/verify_credentials")
1106
1107       assert %{"id" => id, "source" => %{"privacy" => "private"}} = json_response(conn, 200)
1108       assert id == to_string(user.id)
1109     end
1110   end
1111
1112   describe "user relationships" do
1113     setup do: oauth_access(["read:follows"])
1114
1115     test "returns the relationships for the current user", %{user: user, conn: conn} do
1116       other_user = insert(:user)
1117       {:ok, _user} = User.follow(user, other_user)
1118
1119       conn = get(conn, "/api/v1/accounts/relationships", %{"id" => [other_user.id]})
1120
1121       assert [relationship] = json_response(conn, 200)
1122
1123       assert to_string(other_user.id) == relationship["id"]
1124     end
1125
1126     test "returns an empty list on a bad request", %{conn: conn} do
1127       conn = get(conn, "/api/v1/accounts/relationships", %{})
1128
1129       assert [] = json_response(conn, 200)
1130     end
1131   end
1132
1133   test "getting a list of mutes" do
1134     %{user: user, conn: conn} = oauth_access(["read:mutes"])
1135     other_user = insert(:user)
1136
1137     {:ok, _user_relationships} = User.mute(user, other_user)
1138
1139     conn = get(conn, "/api/v1/mutes")
1140
1141     other_user_id = to_string(other_user.id)
1142     assert [%{"id" => ^other_user_id}] = json_response(conn, 200)
1143   end
1144
1145   test "getting a list of blocks" do
1146     %{user: user, conn: conn} = oauth_access(["read:blocks"])
1147     other_user = insert(:user)
1148
1149     {:ok, _user_relationship} = User.block(user, other_user)
1150
1151     conn =
1152       conn
1153       |> assign(:user, user)
1154       |> get("/api/v1/blocks")
1155
1156     other_user_id = to_string(other_user.id)
1157     assert [%{"id" => ^other_user_id}] = json_response(conn, 200)
1158   end
1159 end