1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Web.MastodonAPI.AccountControllerTest do
6 use Pleroma.Web.ConnCase
11 alias Pleroma.Web.ActivityPub.ActivityPub
12 alias Pleroma.Web.ActivityPub.InternalFetchActor
13 alias Pleroma.Web.CommonAPI
14 alias Pleroma.Web.OAuth.Token
16 import Pleroma.Factory
18 describe "account fetching" do
19 setup do: clear_config([:instance, :limit_to_local_content])
22 %User{id: user_id} = insert(:user)
24 assert %{"id" => ^user_id} =
26 |> get("/api/v1/accounts/#{user_id}")
27 |> json_response_and_validate_schema(200)
29 assert %{"error" => "Can't find user"} =
31 |> get("/api/v1/accounts/-1")
32 |> json_response_and_validate_schema(404)
35 test "works by nickname" do
38 assert %{"id" => user_id} =
40 |> get("/api/v1/accounts/#{user.nickname}")
41 |> json_response_and_validate_schema(200)
44 test "works by nickname for remote users" do
45 Config.put([:instance, :limit_to_local_content], false)
47 user = insert(:user, nickname: "user@example.com", local: false)
49 assert %{"id" => user_id} =
51 |> get("/api/v1/accounts/#{user.nickname}")
52 |> json_response_and_validate_schema(200)
55 test "respects limit_to_local_content == :all for remote user nicknames" do
56 Config.put([:instance, :limit_to_local_content], :all)
58 user = insert(:user, nickname: "user@example.com", local: false)
61 |> get("/api/v1/accounts/#{user.nickname}")
62 |> json_response_and_validate_schema(404)
65 test "respects limit_to_local_content == :unauthenticated for remote user nicknames" do
66 Config.put([:instance, :limit_to_local_content], :unauthenticated)
68 user = insert(:user, nickname: "user@example.com", local: false)
69 reading_user = insert(:user)
73 |> get("/api/v1/accounts/#{user.nickname}")
75 assert json_response_and_validate_schema(conn, 404)
79 |> assign(:user, reading_user)
80 |> assign(:token, insert(:oauth_token, user: reading_user, scopes: ["read:accounts"]))
81 |> get("/api/v1/accounts/#{user.nickname}")
83 assert %{"id" => id} = json_response_and_validate_schema(conn, 200)
87 test "accounts fetches correct account for nicknames beginning with numbers", %{conn: conn} do
88 # Need to set an old-style integer ID to reproduce the problem
89 # (these are no longer assigned to new accounts but were preserved
90 # for existing accounts during the migration to flakeIDs)
91 user_one = insert(:user, %{id: 1212})
92 user_two = insert(:user, %{nickname: "#{user_one.id}garbage"})
96 |> get("/api/v1/accounts/#{user_one.id}")
97 |> json_response_and_validate_schema(:ok)
101 |> get("/api/v1/accounts/#{user_two.nickname}")
102 |> json_response_and_validate_schema(:ok)
106 |> get("/api/v1/accounts/#{user_two.id}")
107 |> json_response_and_validate_schema(:ok)
109 refute acc_one == acc_two
110 assert acc_two == acc_three
113 test "returns 404 when user is invisible", %{conn: conn} do
114 user = insert(:user, %{invisible: true})
116 assert %{"error" => "Can't find user"} =
118 |> get("/api/v1/accounts/#{user.nickname}")
119 |> json_response_and_validate_schema(404)
122 test "returns 404 for internal.fetch actor", %{conn: conn} do
123 %User{nickname: "internal.fetch"} = InternalFetchActor.get_actor()
125 assert %{"error" => "Can't find user"} =
127 |> get("/api/v1/accounts/internal.fetch")
128 |> json_response_and_validate_schema(404)
131 test "returns 404 for deactivated user", %{conn: conn} do
132 user = insert(:user, deactivated: true)
134 assert %{"error" => "Can't find user"} =
136 |> get("/api/v1/accounts/#{user.id}")
137 |> json_response_and_validate_schema(:not_found)
141 defp local_and_remote_users do
142 local = insert(:user)
143 remote = insert(:user, local: false)
144 {:ok, local: local, remote: remote}
147 describe "user fetching with restrict unauthenticated profiles for local and remote" do
148 setup do: local_and_remote_users()
150 setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
152 setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
154 test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
155 assert %{"error" => "This API requires an authenticated user"} ==
157 |> get("/api/v1/accounts/#{local.id}")
158 |> json_response_and_validate_schema(:unauthorized)
160 assert %{"error" => "This API requires an authenticated user"} ==
162 |> get("/api/v1/accounts/#{remote.id}")
163 |> json_response_and_validate_schema(:unauthorized)
166 test "if user is authenticated", %{local: local, remote: remote} do
167 %{conn: conn} = oauth_access(["read"])
169 res_conn = get(conn, "/api/v1/accounts/#{local.id}")
170 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
172 res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
173 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
177 describe "user fetching with restrict unauthenticated profiles for local" do
178 setup do: local_and_remote_users()
180 setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
182 test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
183 res_conn = get(conn, "/api/v1/accounts/#{local.id}")
185 assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
186 "error" => "This API requires an authenticated user"
189 res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
190 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
193 test "if user is authenticated", %{local: local, remote: remote} do
194 %{conn: conn} = oauth_access(["read"])
196 res_conn = get(conn, "/api/v1/accounts/#{local.id}")
197 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
199 res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
200 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
204 describe "user fetching with restrict unauthenticated profiles for remote" do
205 setup do: local_and_remote_users()
207 setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
209 test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
210 res_conn = get(conn, "/api/v1/accounts/#{local.id}")
211 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
213 res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
215 assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
216 "error" => "This API requires an authenticated user"
220 test "if user is authenticated", %{local: local, remote: remote} do
221 %{conn: conn} = oauth_access(["read"])
223 res_conn = get(conn, "/api/v1/accounts/#{local.id}")
224 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
226 res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
227 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
231 describe "user timelines" do
232 setup do: oauth_access(["read:statuses"])
234 test "works with announces that are just addressed to public", %{conn: conn} do
235 user = insert(:user, ap_id: "https://honktest/u/test", local: false)
236 other_user = insert(:user)
238 {:ok, post} = CommonAPI.post(other_user, %{status: "bonkeronk"})
242 "@context" => "https://www.w3.org/ns/activitystreams",
243 "actor" => "https://honktest/u/test",
244 "id" => "https://honktest/u/test/bonk/1793M7B9MQ48847vdx",
245 "object" => post.data["object"],
246 "published" => "2019-06-25T19:33:58Z",
247 "to" => ["https://www.w3.org/ns/activitystreams#Public"],
250 |> ActivityPub.persist(local: false)
254 |> get("/api/v1/accounts/#{user.id}/statuses")
255 |> json_response_and_validate_schema(200)
257 assert [%{"id" => id}] = resp
258 assert id == announce.id
261 test "deactivated user", %{conn: conn} do
262 user = insert(:user, deactivated: true)
264 assert %{"error" => "Can't find user"} ==
266 |> get("/api/v1/accounts/#{user.id}/statuses")
267 |> json_response_and_validate_schema(:not_found)
270 test "returns 404 when user is invisible", %{conn: conn} do
271 user = insert(:user, %{invisible: true})
273 assert %{"error" => "Can't find user"} =
275 |> get("/api/v1/accounts/#{user.id}")
276 |> json_response_and_validate_schema(404)
279 test "respects blocks", %{user: user_one, conn: conn} do
280 user_two = insert(:user)
281 user_three = insert(:user)
283 User.block(user_one, user_two)
285 {:ok, activity} = CommonAPI.post(user_two, %{status: "User one sux0rz"})
286 {:ok, repeat} = CommonAPI.repeat(activity.id, user_three)
290 |> get("/api/v1/accounts/#{user_two.id}/statuses")
291 |> json_response_and_validate_schema(200)
293 assert [%{"id" => id}] = resp
294 assert id == activity.id
296 # Even a blocked user will deliver the full user timeline, there would be
297 # no point in looking at a blocked users timeline otherwise
300 |> get("/api/v1/accounts/#{user_two.id}/statuses")
301 |> json_response_and_validate_schema(200)
303 assert [%{"id" => id}] = resp
304 assert id == activity.id
306 # Third user's timeline includes the repeat when viewed by unauthenticated user
309 |> get("/api/v1/accounts/#{user_three.id}/statuses")
310 |> json_response_and_validate_schema(200)
312 assert [%{"id" => id}] = resp
313 assert id == repeat.id
315 # When viewing a third user's timeline, the blocked users' statuses will NOT be shown
316 resp = get(conn, "/api/v1/accounts/#{user_three.id}/statuses")
318 assert [] == json_response_and_validate_schema(resp, 200)
321 test "gets users statuses", %{conn: conn} do
322 user_one = insert(:user)
323 user_two = insert(:user)
324 user_three = insert(:user)
326 {:ok, _user_three} = User.follow(user_three, user_one)
328 {:ok, activity} = CommonAPI.post(user_one, %{status: "HI!!!"})
330 {:ok, direct_activity} =
331 CommonAPI.post(user_one, %{
332 status: "Hi, @#{user_two.nickname}.",
336 {:ok, private_activity} =
337 CommonAPI.post(user_one, %{status: "private", visibility: "private"})
342 |> get("/api/v1/accounts/#{user_one.id}/statuses")
343 |> json_response_and_validate_schema(200)
345 assert [%{"id" => id}] = resp
346 assert id == to_string(activity.id)
350 |> assign(:user, user_two)
351 |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
352 |> get("/api/v1/accounts/#{user_one.id}/statuses")
353 |> json_response_and_validate_schema(200)
355 assert [%{"id" => id_one}, %{"id" => id_two}] = resp
356 assert id_one == to_string(direct_activity.id)
357 assert id_two == to_string(activity.id)
361 |> assign(:user, user_three)
362 |> assign(:token, insert(:oauth_token, user: user_three, scopes: ["read:statuses"]))
363 |> get("/api/v1/accounts/#{user_one.id}/statuses")
364 |> json_response_and_validate_schema(200)
366 assert [%{"id" => id_one}, %{"id" => id_two}] = resp
367 assert id_one == to_string(private_activity.id)
368 assert id_two == to_string(activity.id)
371 test "unimplemented pinned statuses feature", %{conn: conn} do
372 note = insert(:note_activity)
373 user = User.get_cached_by_ap_id(note.data["actor"])
375 conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?pinned=true")
377 assert json_response_and_validate_schema(conn, 200) == []
380 test "gets an users media, excludes reblogs", %{conn: conn} do
381 note = insert(:note_activity)
382 user = User.get_cached_by_ap_id(note.data["actor"])
383 other_user = insert(:user)
386 content_type: "image/jpg",
387 path: Path.absname("test/fixtures/image.jpg"),
388 filename: "an_image.jpg"
391 {:ok, %{id: media_id}} = ActivityPub.upload(file, actor: user.ap_id)
393 {:ok, %{id: image_post_id}} = CommonAPI.post(user, %{status: "cofe", media_ids: [media_id]})
395 {:ok, %{id: media_id}} = ActivityPub.upload(file, actor: other_user.ap_id)
397 {:ok, %{id: other_image_post_id}} =
398 CommonAPI.post(other_user, %{status: "cofe2", media_ids: [media_id]})
400 {:ok, _announce} = CommonAPI.repeat(other_image_post_id, user)
402 conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?only_media=true")
404 assert [%{"id" => ^image_post_id}] = json_response_and_validate_schema(conn, 200)
406 conn = get(build_conn(), "/api/v1/accounts/#{user.id}/statuses?only_media=1")
408 assert [%{"id" => ^image_post_id}] = json_response_and_validate_schema(conn, 200)
411 test "gets a user's statuses without reblogs", %{user: user, conn: conn} do
412 {:ok, %{id: post_id}} = CommonAPI.post(user, %{status: "HI!!!"})
413 {:ok, _} = CommonAPI.repeat(post_id, user)
415 conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_reblogs=true")
416 assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)
418 conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_reblogs=1")
419 assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)
422 test "filters user's statuses by a hashtag", %{user: user, conn: conn} do
423 {:ok, %{id: post_id}} = CommonAPI.post(user, %{status: "#hashtag"})
424 {:ok, _post} = CommonAPI.post(user, %{status: "hashtag"})
426 conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?tagged=hashtag")
427 assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)
430 test "the user views their own timelines and excludes direct messages", %{
434 {:ok, %{id: public_activity_id}} =
435 CommonAPI.post(user, %{status: ".", visibility: "public"})
437 {:ok, _direct_activity} = CommonAPI.post(user, %{status: ".", visibility: "direct"})
439 conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_visibilities[]=direct")
440 assert [%{"id" => ^public_activity_id}] = json_response_and_validate_schema(conn, 200)
444 defp local_and_remote_activities(%{local: local, remote: remote}) do
445 insert(:note_activity, user: local)
446 insert(:note_activity, user: remote, local: false)
451 describe "statuses with restrict unauthenticated profiles for local and remote" do
452 setup do: local_and_remote_users()
453 setup :local_and_remote_activities
455 setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
457 setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
459 test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
460 assert %{"error" => "This API requires an authenticated user"} ==
462 |> get("/api/v1/accounts/#{local.id}/statuses")
463 |> json_response_and_validate_schema(:unauthorized)
465 assert %{"error" => "This API requires an authenticated user"} ==
467 |> get("/api/v1/accounts/#{remote.id}/statuses")
468 |> json_response_and_validate_schema(:unauthorized)
471 test "if user is authenticated", %{local: local, remote: remote} do
472 %{conn: conn} = oauth_access(["read"])
474 res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
475 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
477 res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
478 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
482 describe "statuses with restrict unauthenticated profiles for local" do
483 setup do: local_and_remote_users()
484 setup :local_and_remote_activities
486 setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
488 test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
489 assert %{"error" => "This API requires an authenticated user"} ==
491 |> get("/api/v1/accounts/#{local.id}/statuses")
492 |> json_response_and_validate_schema(:unauthorized)
494 res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
495 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
498 test "if user is authenticated", %{local: local, remote: remote} do
499 %{conn: conn} = oauth_access(["read"])
501 res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
502 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
504 res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
505 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
509 describe "statuses with restrict unauthenticated profiles for remote" do
510 setup do: local_and_remote_users()
511 setup :local_and_remote_activities
513 setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
515 test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
516 res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
517 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
519 assert %{"error" => "This API requires an authenticated user"} ==
521 |> get("/api/v1/accounts/#{remote.id}/statuses")
522 |> json_response_and_validate_schema(:unauthorized)
525 test "if user is authenticated", %{local: local, remote: remote} do
526 %{conn: conn} = oauth_access(["read"])
528 res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
529 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
531 res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
532 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
536 describe "followers" do
537 setup do: oauth_access(["read:accounts"])
539 test "getting followers", %{user: user, conn: conn} do
540 other_user = insert(:user)
541 {:ok, %{id: user_id}} = User.follow(user, other_user)
543 conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")
545 assert [%{"id" => ^user_id}] = json_response_and_validate_schema(conn, 200)
548 test "getting followers, hide_followers", %{user: user, conn: conn} do
549 other_user = insert(:user, hide_followers: true)
550 {:ok, _user} = User.follow(user, other_user)
552 conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")
554 assert [] == json_response_and_validate_schema(conn, 200)
557 test "getting followers, hide_followers, same user requesting" do
559 other_user = insert(:user, hide_followers: true)
560 {:ok, _user} = User.follow(user, other_user)
564 |> assign(:user, other_user)
565 |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
566 |> get("/api/v1/accounts/#{other_user.id}/followers")
568 refute [] == json_response_and_validate_schema(conn, 200)
571 test "getting followers, pagination", %{user: user, conn: conn} do
572 {:ok, %User{id: follower1_id}} = :user |> insert() |> User.follow(user)
573 {:ok, %User{id: follower2_id}} = :user |> insert() |> User.follow(user)
574 {:ok, %User{id: follower3_id}} = :user |> insert() |> User.follow(user)
576 assert [%{"id" => ^follower3_id}, %{"id" => ^follower2_id}] =
578 |> get("/api/v1/accounts/#{user.id}/followers?since_id=#{follower1_id}")
579 |> json_response_and_validate_schema(200)
581 assert [%{"id" => ^follower2_id}, %{"id" => ^follower1_id}] =
583 |> get("/api/v1/accounts/#{user.id}/followers?max_id=#{follower3_id}")
584 |> json_response_and_validate_schema(200)
586 assert [%{"id" => ^follower2_id}, %{"id" => ^follower1_id}] =
589 "/api/v1/accounts/#{user.id}/followers?id=#{user.id}&limit=20&max_id=#{
593 |> json_response_and_validate_schema(200)
595 res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?limit=1&max_id=#{follower3_id}")
597 assert [%{"id" => ^follower2_id}] = json_response_and_validate_schema(res_conn, 200)
599 assert [link_header] = get_resp_header(res_conn, "link")
600 assert link_header =~ ~r/min_id=#{follower2_id}/
601 assert link_header =~ ~r/max_id=#{follower2_id}/
605 describe "following" do
606 setup do: oauth_access(["read:accounts"])
608 test "getting following", %{user: user, conn: conn} do
609 other_user = insert(:user)
610 {:ok, user} = User.follow(user, other_user)
612 conn = get(conn, "/api/v1/accounts/#{user.id}/following")
614 assert [%{"id" => id}] = json_response_and_validate_schema(conn, 200)
615 assert id == to_string(other_user.id)
618 test "getting following, hide_follows, other user requesting" do
619 user = insert(:user, hide_follows: true)
620 other_user = insert(:user)
621 {:ok, user} = User.follow(user, other_user)
625 |> assign(:user, other_user)
626 |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
627 |> get("/api/v1/accounts/#{user.id}/following")
629 assert [] == json_response_and_validate_schema(conn, 200)
632 test "getting following, hide_follows, same user requesting" do
633 user = insert(:user, hide_follows: true)
634 other_user = insert(:user)
635 {:ok, user} = User.follow(user, other_user)
639 |> assign(:user, user)
640 |> assign(:token, insert(:oauth_token, user: user, scopes: ["read:accounts"]))
641 |> get("/api/v1/accounts/#{user.id}/following")
643 refute [] == json_response_and_validate_schema(conn, 200)
646 test "getting following, pagination", %{user: user, conn: conn} do
647 following1 = insert(:user)
648 following2 = insert(:user)
649 following3 = insert(:user)
650 {:ok, _} = User.follow(user, following1)
651 {:ok, _} = User.follow(user, following2)
652 {:ok, _} = User.follow(user, following3)
654 res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?since_id=#{following1.id}")
656 assert [%{"id" => id3}, %{"id" => id2}] = json_response_and_validate_schema(res_conn, 200)
657 assert id3 == following3.id
658 assert id2 == following2.id
660 res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?max_id=#{following3.id}")
662 assert [%{"id" => id2}, %{"id" => id1}] = json_response_and_validate_schema(res_conn, 200)
663 assert id2 == following2.id
664 assert id1 == following1.id
669 "/api/v1/accounts/#{user.id}/following?id=#{user.id}&limit=20&max_id=#{following3.id}"
672 assert [%{"id" => id2}, %{"id" => id1}] = json_response_and_validate_schema(res_conn, 200)
673 assert id2 == following2.id
674 assert id1 == following1.id
677 get(conn, "/api/v1/accounts/#{user.id}/following?limit=1&max_id=#{following3.id}")
679 assert [%{"id" => id2}] = json_response_and_validate_schema(res_conn, 200)
680 assert id2 == following2.id
682 assert [link_header] = get_resp_header(res_conn, "link")
683 assert link_header =~ ~r/min_id=#{following2.id}/
684 assert link_header =~ ~r/max_id=#{following2.id}/
688 describe "follow/unfollow" do
689 setup do: oauth_access(["follow"])
691 test "following / unfollowing a user", %{conn: conn} do
692 %{id: other_user_id, nickname: other_user_nickname} = insert(:user)
694 assert %{"id" => _id, "following" => true} =
696 |> post("/api/v1/accounts/#{other_user_id}/follow")
697 |> json_response_and_validate_schema(200)
699 assert %{"id" => _id, "following" => false} =
701 |> post("/api/v1/accounts/#{other_user_id}/unfollow")
702 |> json_response_and_validate_schema(200)
704 assert %{"id" => ^other_user_id} =
706 |> put_req_header("content-type", "application/json")
707 |> post("/api/v1/follows", %{"uri" => other_user_nickname})
708 |> json_response_and_validate_schema(200)
711 test "cancelling follow request", %{conn: conn} do
712 %{id: other_user_id} = insert(:user, %{locked: true})
714 assert %{"id" => ^other_user_id, "following" => false, "requested" => true} =
716 |> post("/api/v1/accounts/#{other_user_id}/follow")
717 |> json_response_and_validate_schema(:ok)
719 assert %{"id" => ^other_user_id, "following" => false, "requested" => false} =
721 |> post("/api/v1/accounts/#{other_user_id}/unfollow")
722 |> json_response_and_validate_schema(:ok)
725 test "following without reblogs" do
726 %{conn: conn} = oauth_access(["follow", "read:statuses"])
727 followed = insert(:user)
728 other_user = insert(:user)
732 |> put_req_header("content-type", "application/json")
733 |> post("/api/v1/accounts/#{followed.id}/follow", %{reblogs: false})
735 assert %{"showing_reblogs" => false} = json_response_and_validate_schema(ret_conn, 200)
737 {:ok, activity} = CommonAPI.post(other_user, %{status: "hey"})
738 {:ok, %{id: reblog_id}} = CommonAPI.repeat(activity.id, followed)
742 |> get("/api/v1/timelines/home")
743 |> json_response(200)
745 assert %{"showing_reblogs" => true} =
747 |> put_req_header("content-type", "application/json")
748 |> post("/api/v1/accounts/#{followed.id}/follow", %{reblogs: true})
749 |> json_response_and_validate_schema(200)
751 assert [%{"id" => ^reblog_id}] =
753 |> get("/api/v1/timelines/home")
754 |> json_response(200)
757 test "following with reblogs" do
758 %{conn: conn} = oauth_access(["follow", "read:statuses"])
759 followed = insert(:user)
760 other_user = insert(:user)
762 ret_conn = post(conn, "/api/v1/accounts/#{followed.id}/follow")
764 assert %{"showing_reblogs" => true} = json_response_and_validate_schema(ret_conn, 200)
766 {:ok, activity} = CommonAPI.post(other_user, %{status: "hey"})
767 {:ok, %{id: reblog_id}} = CommonAPI.repeat(activity.id, followed)
769 assert [%{"id" => ^reblog_id}] =
771 |> get("/api/v1/timelines/home")
772 |> json_response(200)
774 assert %{"showing_reblogs" => false} =
776 |> put_req_header("content-type", "application/json")
777 |> post("/api/v1/accounts/#{followed.id}/follow", %{reblogs: false})
778 |> json_response_and_validate_schema(200)
782 |> get("/api/v1/timelines/home")
783 |> json_response(200)
786 test "following / unfollowing errors", %{user: user, conn: conn} do
788 conn_res = post(conn, "/api/v1/accounts/#{user.id}/follow")
790 assert %{"error" => "Can not follow yourself"} =
791 json_response_and_validate_schema(conn_res, 400)
794 user = User.get_cached_by_id(user.id)
795 conn_res = post(conn, "/api/v1/accounts/#{user.id}/unfollow")
797 assert %{"error" => "Can not unfollow yourself"} =
798 json_response_and_validate_schema(conn_res, 400)
800 # self follow via uri
801 user = User.get_cached_by_id(user.id)
803 assert %{"error" => "Can not follow yourself"} =
805 |> put_req_header("content-type", "multipart/form-data")
806 |> post("/api/v1/follows", %{"uri" => user.nickname})
807 |> json_response_and_validate_schema(400)
809 # follow non existing user
810 conn_res = post(conn, "/api/v1/accounts/doesntexist/follow")
811 assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)
813 # follow non existing user via uri
816 |> put_req_header("content-type", "multipart/form-data")
817 |> post("/api/v1/follows", %{"uri" => "doesntexist"})
819 assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)
821 # unfollow non existing user
822 conn_res = post(conn, "/api/v1/accounts/doesntexist/unfollow")
823 assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)
827 describe "mute/unmute" do
828 setup do: oauth_access(["write:mutes"])
830 test "with notifications", %{conn: conn} do
831 other_user = insert(:user)
833 assert %{"id" => _id, "muting" => true, "muting_notifications" => true} =
835 |> post("/api/v1/accounts/#{other_user.id}/mute")
836 |> json_response_and_validate_schema(200)
838 conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")
840 assert %{"id" => _id, "muting" => false, "muting_notifications" => false} =
841 json_response_and_validate_schema(conn, 200)
844 test "without notifications", %{conn: conn} do
845 other_user = insert(:user)
849 |> put_req_header("content-type", "multipart/form-data")
850 |> post("/api/v1/accounts/#{other_user.id}/mute", %{"notifications" => "false"})
852 assert %{"id" => _id, "muting" => true, "muting_notifications" => false} =
853 json_response_and_validate_schema(ret_conn, 200)
855 conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")
857 assert %{"id" => _id, "muting" => false, "muting_notifications" => false} =
858 json_response_and_validate_schema(conn, 200)
862 describe "pinned statuses" do
865 {:ok, activity} = CommonAPI.post(user, %{status: "HI!!!"})
866 %{conn: conn} = oauth_access(["read:statuses"], user: user)
868 [conn: conn, user: user, activity: activity]
871 test "returns pinned statuses", %{conn: conn, user: user, activity: %{id: activity_id}} do
872 {:ok, _} = CommonAPI.pin(activity_id, user)
874 assert [%{"id" => ^activity_id, "pinned" => true}] =
876 |> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
877 |> json_response_and_validate_schema(200)
881 test "blocking / unblocking a user" do
882 %{conn: conn} = oauth_access(["follow"])
883 other_user = insert(:user)
885 ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/block")
887 assert %{"id" => _id, "blocking" => true} = json_response_and_validate_schema(ret_conn, 200)
889 conn = post(conn, "/api/v1/accounts/#{other_user.id}/unblock")
891 assert %{"id" => _id, "blocking" => false} = json_response_and_validate_schema(conn, 200)
894 describe "create account by app" do
898 email: "lain@example.org",
899 password: "PlzDontHackLain",
903 [valid_params: valid_params]
906 test "Account registration via Application, no confirmation required", %{conn: conn} do
907 clear_config([:instance, :account_activation_required], false)
911 |> put_req_header("content-type", "application/json")
912 |> post("/api/v1/apps", %{
913 client_name: "client_name",
914 redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
915 scopes: "read, write, follow"
919 "client_id" => client_id,
920 "client_secret" => client_secret,
922 "name" => "client_name",
923 "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
926 } = json_response_and_validate_schema(conn, 200)
929 post(conn, "/oauth/token", %{
930 grant_type: "client_credentials",
931 client_id: client_id,
932 client_secret: client_secret
935 assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
936 json_response(conn, 200)
939 token_from_db = Repo.get_by(Token, token: token)
942 assert scope == "read write follow"
946 |> put_req_header("content-type", "multipart/form-data")
947 |> put_req_header("authorization", "Bearer " <> token)
948 |> post("/api/v1/accounts", %{
950 email: "lain@example.org",
951 password: "PlzDontHackLain",
957 "access_token" => token,
958 "created_at" => _created_at,
960 "token_type" => "Bearer"
961 } = json_response_and_validate_schema(conn, 200)
963 token_from_db = Repo.get_by(Token, token: token)
965 token_from_db = Repo.preload(token_from_db, :user)
966 assert token_from_db.user
967 refute token_from_db.user.confirmation_pending
970 setup do: clear_config([:instance, :account_approval_required])
972 test "Account registration via Application", %{conn: conn} do
973 clear_config([:instance, :account_activation_required], true)
977 |> put_req_header("content-type", "application/json")
978 |> post("/api/v1/apps", %{
979 client_name: "client_name",
980 redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
981 scopes: "read, write, follow"
985 "client_id" => client_id,
986 "client_secret" => client_secret,
988 "name" => "client_name",
989 "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
992 } = json_response_and_validate_schema(conn, 200)
995 post(conn, "/oauth/token", %{
996 grant_type: "client_credentials",
997 client_id: client_id,
998 client_secret: client_secret
1001 assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
1002 json_response(conn, 200)
1005 token_from_db = Repo.get_by(Token, token: token)
1006 assert token_from_db
1008 assert scope == "read write follow"
1012 |> put_req_header("content-type", "multipart/form-data")
1013 |> put_req_header("authorization", "Bearer " <> token)
1014 |> post("/api/v1/accounts", %{
1016 email: "lain@example.org",
1017 password: "PlzDontHackLain",
1023 "access_token" => token,
1024 "created_at" => _created_at,
1026 "token_type" => "Bearer"
1027 } = json_response_and_validate_schema(conn, 200)
1029 token_from_db = Repo.get_by(Token, token: token)
1030 assert token_from_db
1031 token_from_db = Repo.preload(token_from_db, :user)
1032 assert token_from_db.user
1034 assert token_from_db.user.confirmation_pending
1037 test "Account registration via app with account_approval_required", %{conn: conn} do
1038 Pleroma.Config.put([:instance, :account_approval_required], true)
1042 |> put_req_header("content-type", "application/json")
1043 |> post("/api/v1/apps", %{
1044 client_name: "client_name",
1045 redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
1046 scopes: "read, write, follow"
1050 "client_id" => client_id,
1051 "client_secret" => client_secret,
1053 "name" => "client_name",
1054 "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
1057 } = json_response_and_validate_schema(conn, 200)
1060 post(conn, "/oauth/token", %{
1061 grant_type: "client_credentials",
1062 client_id: client_id,
1063 client_secret: client_secret
1066 assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
1067 json_response(conn, 200)
1070 token_from_db = Repo.get_by(Token, token: token)
1071 assert token_from_db
1073 assert scope == "read write follow"
1077 |> put_req_header("content-type", "multipart/form-data")
1078 |> put_req_header("authorization", "Bearer " <> token)
1079 |> post("/api/v1/accounts", %{
1081 email: "lain@example.org",
1082 password: "PlzDontHackLain",
1085 reason: "I'm a cool dude, bro"
1089 "access_token" => token,
1090 "created_at" => _created_at,
1092 "token_type" => "Bearer"
1093 } = json_response_and_validate_schema(conn, 200)
1095 token_from_db = Repo.get_by(Token, token: token)
1096 assert token_from_db
1097 token_from_db = Repo.preload(token_from_db, :user)
1098 assert token_from_db.user
1100 assert token_from_db.user.approval_pending
1102 assert token_from_db.user.registration_reason == "I'm a cool dude, bro"
1105 test "returns error when user already registred", %{conn: conn, valid_params: valid_params} do
1106 _user = insert(:user, email: "lain@example.org")
1107 app_token = insert(:oauth_token, user: nil)
1111 |> put_req_header("authorization", "Bearer " <> app_token.token)
1112 |> put_req_header("content-type", "application/json")
1113 |> post("/api/v1/accounts", valid_params)
1115 assert json_response_and_validate_schema(res, 400) == %{
1116 "error" => "{\"email\":[\"has already been taken\"]}"
1120 test "returns bad_request if missing required params", %{
1122 valid_params: valid_params
1124 app_token = insert(:oauth_token, user: nil)
1128 |> put_req_header("authorization", "Bearer " <> app_token.token)
1129 |> put_req_header("content-type", "application/json")
1131 res = post(conn, "/api/v1/accounts", valid_params)
1132 assert json_response_and_validate_schema(res, 200)
1134 [{127, 0, 0, 1}, {127, 0, 0, 2}, {127, 0, 0, 3}, {127, 0, 0, 4}]
1135 |> Stream.zip(Map.delete(valid_params, :email))
1136 |> Enum.each(fn {ip, {attr, _}} ->
1139 |> Map.put(:remote_ip, ip)
1140 |> post("/api/v1/accounts", Map.delete(valid_params, attr))
1141 |> json_response_and_validate_schema(400)
1144 "error" => "Missing field: #{attr}.",
1147 "message" => "Missing field: #{attr}",
1148 "source" => %{"pointer" => "/#{attr}"},
1149 "title" => "Invalid value"
1156 setup do: clear_config([:instance, :account_activation_required])
1158 test "returns bad_request if missing email params when :account_activation_required is enabled",
1159 %{conn: conn, valid_params: valid_params} do
1160 Pleroma.Config.put([:instance, :account_activation_required], true)
1162 app_token = insert(:oauth_token, user: nil)
1166 |> put_req_header("authorization", "Bearer " <> app_token.token)
1167 |> put_req_header("content-type", "application/json")
1171 |> Map.put(:remote_ip, {127, 0, 0, 5})
1172 |> post("/api/v1/accounts", Map.delete(valid_params, :email))
1174 assert json_response_and_validate_schema(res, 400) ==
1175 %{"error" => "Missing parameter: email"}
1179 |> Map.put(:remote_ip, {127, 0, 0, 6})
1180 |> post("/api/v1/accounts", Map.put(valid_params, :email, ""))
1182 assert json_response_and_validate_schema(res, 400) == %{
1183 "error" => "{\"email\":[\"can't be blank\"]}"
1187 test "allow registration without an email", %{conn: conn, valid_params: valid_params} do
1188 app_token = insert(:oauth_token, user: nil)
1189 conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
1193 |> put_req_header("content-type", "application/json")
1194 |> Map.put(:remote_ip, {127, 0, 0, 7})
1195 |> post("/api/v1/accounts", Map.delete(valid_params, :email))
1197 assert json_response_and_validate_schema(res, 200)
1200 test "allow registration with an empty email", %{conn: conn, valid_params: valid_params} do
1201 app_token = insert(:oauth_token, user: nil)
1202 conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
1206 |> put_req_header("content-type", "application/json")
1207 |> Map.put(:remote_ip, {127, 0, 0, 8})
1208 |> post("/api/v1/accounts", Map.put(valid_params, :email, ""))
1210 assert json_response_and_validate_schema(res, 200)
1213 test "returns forbidden if token is invalid", %{conn: conn, valid_params: valid_params} do
1216 |> put_req_header("authorization", "Bearer " <> "invalid-token")
1217 |> put_req_header("content-type", "multipart/form-data")
1218 |> post("/api/v1/accounts", valid_params)
1220 assert json_response_and_validate_schema(res, 403) == %{"error" => "Invalid credentials"}
1223 test "registration from trusted app" do
1224 clear_config([Pleroma.Captcha, :enabled], true)
1225 app = insert(:oauth_app, trusted: true, scopes: ["read", "write", "follow", "push"])
1229 |> post("/oauth/token", %{
1230 "grant_type" => "client_credentials",
1231 "client_id" => app.client_id,
1232 "client_secret" => app.client_secret
1235 assert %{"access_token" => token, "token_type" => "Bearer"} = json_response(conn, 200)
1239 |> Plug.Conn.put_req_header("authorization", "Bearer " <> token)
1240 |> put_req_header("content-type", "multipart/form-data")
1241 |> post("/api/v1/accounts", %{
1242 nickname: "nickanme",
1244 email: "email@example.com",
1247 password: "some_password",
1248 confirm: "some_password"
1250 |> json_response_and_validate_schema(200)
1253 "access_token" => access_token,
1255 "scope" => "read write follow push",
1256 "token_type" => "Bearer"
1261 |> Plug.Conn.put_req_header("authorization", "Bearer " <> access_token)
1262 |> get("/api/v1/accounts/verify_credentials")
1263 |> json_response_and_validate_schema(200)
1268 "display_name" => "Lain",
1269 "follow_requests_count" => 0,
1270 "followers_count" => 0,
1271 "following_count" => 0,
1278 "actor_type" => "Person",
1279 "discoverable" => false,
1280 "no_rich_text" => false,
1283 "privacy" => "public",
1284 "sensitive" => false
1286 "statuses_count" => 0,
1287 "username" => "Lain"
1292 describe "create account by app / rate limit" do
1293 setup do: clear_config([:rate_limit, :app_account_creation], {10_000, 2})
1295 test "respects rate limit setting", %{conn: conn} do
1296 app_token = insert(:oauth_token, user: nil)
1300 |> put_req_header("authorization", "Bearer " <> app_token.token)
1301 |> Map.put(:remote_ip, {15, 15, 15, 15})
1302 |> put_req_header("content-type", "multipart/form-data")
1307 |> post("/api/v1/accounts", %{
1308 username: "#{i}lain",
1309 email: "#{i}lain@example.org",
1310 password: "PlzDontHackLain",
1315 "access_token" => token,
1316 "created_at" => _created_at,
1318 "token_type" => "Bearer"
1319 } = json_response_and_validate_schema(conn, 200)
1321 token_from_db = Repo.get_by(Token, token: token)
1322 assert token_from_db
1323 token_from_db = Repo.preload(token_from_db, :user)
1324 assert token_from_db.user
1328 post(conn, "/api/v1/accounts", %{
1330 email: "6lain@example.org",
1331 password: "PlzDontHackLain",
1335 assert json_response_and_validate_schema(conn, :too_many_requests) == %{
1336 "error" => "Throttled"
1341 describe "create account with enabled captcha" do
1342 setup %{conn: conn} do
1343 app_token = insert(:oauth_token, user: nil)
1347 |> put_req_header("authorization", "Bearer " <> app_token.token)
1348 |> put_req_header("content-type", "multipart/form-data")
1353 setup do: clear_config([Pleroma.Captcha, :enabled], true)
1355 test "creates an account and returns 200 if captcha is valid", %{conn: conn} do
1356 %{token: token, answer_data: answer_data} = Pleroma.Captcha.new()
1360 email: "lain@example.org",
1361 password: "PlzDontHackLain",
1363 captcha_solution: Pleroma.Captcha.Mock.solution(),
1364 captcha_token: token,
1365 captcha_answer_data: answer_data
1369 "access_token" => access_token,
1372 "token_type" => "Bearer"
1375 |> post("/api/v1/accounts", params)
1376 |> json_response_and_validate_schema(:ok)
1378 assert Token |> Repo.get_by(token: access_token) |> Repo.preload(:user) |> Map.get(:user)
1380 Cachex.del(:used_captcha_cache, token)
1383 test "returns 400 if any captcha field is not provided", %{conn: conn} do
1384 captcha_fields = [:captcha_solution, :captcha_token, :captcha_answer_data]
1388 email: "lain@example.org",
1389 password: "PlzDontHackLain",
1391 captcha_solution: "xx",
1392 captcha_token: "xx",
1393 captcha_answer_data: "xx"
1396 for field <- captcha_fields do
1398 "error" => "{\"captcha\":[\"Invalid CAPTCHA (Missing parameter: #{field})\"]}"
1403 |> post("/api/v1/accounts", Map.delete(valid_params, field))
1404 |> json_response_and_validate_schema(:bad_request)
1408 test "returns an error if captcha is invalid", %{conn: conn} do
1411 email: "lain@example.org",
1412 password: "PlzDontHackLain",
1414 captcha_solution: "cofe",
1415 captcha_token: "cofe",
1416 captcha_answer_data: "cofe"
1419 assert %{"error" => "{\"captcha\":[\"Invalid answer data\"]}"} ==
1421 |> post("/api/v1/accounts", params)
1422 |> json_response_and_validate_schema(:bad_request)
1426 describe "GET /api/v1/accounts/:id/lists - account_lists" do
1427 test "returns lists to which the account belongs" do
1428 %{user: user, conn: conn} = oauth_access(["read:lists"])
1429 other_user = insert(:user)
1430 assert {:ok, %Pleroma.List{id: list_id} = list} = Pleroma.List.create("Test List", user)
1431 {:ok, %{following: _following}} = Pleroma.List.follow(list, other_user)
1433 assert [%{"id" => list_id, "title" => "Test List"}] =
1435 |> get("/api/v1/accounts/#{other_user.id}/lists")
1436 |> json_response_and_validate_schema(200)
1440 describe "verify_credentials" do
1441 test "verify_credentials" do
1442 %{user: user, conn: conn} = oauth_access(["read:accounts"])
1443 [notification | _] = insert_list(7, :notification, user: user)
1444 Pleroma.Notification.set_read_up_to(user, notification.id)
1445 conn = get(conn, "/api/v1/accounts/verify_credentials")
1447 response = json_response_and_validate_schema(conn, 200)
1449 assert %{"id" => id, "source" => %{"privacy" => "public"}} = response
1450 assert response["pleroma"]["chat_token"]
1451 assert response["pleroma"]["unread_notifications_count"] == 6
1452 assert id == to_string(user.id)
1455 test "verify_credentials default scope unlisted" do
1456 user = insert(:user, default_scope: "unlisted")
1457 %{conn: conn} = oauth_access(["read:accounts"], user: user)
1459 conn = get(conn, "/api/v1/accounts/verify_credentials")
1461 assert %{"id" => id, "source" => %{"privacy" => "unlisted"}} =
1462 json_response_and_validate_schema(conn, 200)
1464 assert id == to_string(user.id)
1467 test "locked accounts" do
1468 user = insert(:user, default_scope: "private")
1469 %{conn: conn} = oauth_access(["read:accounts"], user: user)
1471 conn = get(conn, "/api/v1/accounts/verify_credentials")
1473 assert %{"id" => id, "source" => %{"privacy" => "private"}} =
1474 json_response_and_validate_schema(conn, 200)
1476 assert id == to_string(user.id)
1480 describe "user relationships" do
1481 setup do: oauth_access(["read:follows"])
1483 test "returns the relationships for the current user", %{user: user, conn: conn} do
1484 %{id: other_user_id} = other_user = insert(:user)
1485 {:ok, _user} = User.follow(user, other_user)
1487 assert [%{"id" => ^other_user_id}] =
1489 |> get("/api/v1/accounts/relationships?id=#{other_user.id}")
1490 |> json_response_and_validate_schema(200)
1492 assert [%{"id" => ^other_user_id}] =
1494 |> get("/api/v1/accounts/relationships?id[]=#{other_user.id}")
1495 |> json_response_and_validate_schema(200)
1498 test "returns an empty list on a bad request", %{conn: conn} do
1499 conn = get(conn, "/api/v1/accounts/relationships", %{})
1501 assert [] = json_response_and_validate_schema(conn, 200)
1505 test "getting a list of mutes" do
1506 %{user: user, conn: conn} = oauth_access(["read:mutes"])
1507 other_user = insert(:user)
1509 {:ok, _user_relationships} = User.mute(user, other_user)
1511 conn = get(conn, "/api/v1/mutes")
1513 other_user_id = to_string(other_user.id)
1514 assert [%{"id" => ^other_user_id}] = json_response_and_validate_schema(conn, 200)
1517 test "getting a list of blocks" do
1518 %{user: user, conn: conn} = oauth_access(["read:blocks"])
1519 other_user = insert(:user)
1521 {:ok, _user_relationship} = User.block(user, other_user)
1525 |> assign(:user, user)
1526 |> get("/api/v1/blocks")
1528 other_user_id = to_string(other_user.id)
1529 assert [%{"id" => ^other_user_id}] = json_response_and_validate_schema(conn, 200)