git.squeep.com Git - akkoma/blob - test/web/mastodon_api/controllers/account_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.AccountControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   alias Pleroma.Repo
   9   alias Pleroma.User
  10   alias Pleroma.Web.ActivityPub.ActivityPub
  11   alias Pleroma.Web.ActivityPub.InternalFetchActor
  12   alias Pleroma.Web.CommonAPI
  13   alias Pleroma.Web.OAuth.Token
  14
  15   import Pleroma.Factory
  16
  17   describe "account fetching" do
  18     clear_config([:instance, :limit_to_local_content])
  19
  20     test "works by id" do
  21       user = insert(:user)
  22
  23       conn =
  24         build_conn()
  25         |> get("/api/v1/accounts/#{user.id}")
  26
  27       assert %{"id" => id} = json_response(conn, 200)
  28       assert id == to_string(user.id)
  29
  30       conn =
  31         build_conn()
  32         |> get("/api/v1/accounts/-1")
  33
  34       assert %{"error" => "Can't find user"} = json_response(conn, 404)
  35     end
  36
  37     test "works by nickname" do
  38       user = insert(:user)
  39
  40       conn =
  41         build_conn()
  42         |> get("/api/v1/accounts/#{user.nickname}")
  43
  44       assert %{"id" => id} = json_response(conn, 200)
  45       assert id == user.id
  46     end
  47
  48     test "works by nickname for remote users" do
  49       Pleroma.Config.put([:instance, :limit_to_local_content], false)
  50       user = insert(:user, nickname: "user@example.com", local: false)
  51
  52       conn =
  53         build_conn()
  54         |> get("/api/v1/accounts/#{user.nickname}")
  55
  56       assert %{"id" => id} = json_response(conn, 200)
  57       assert id == user.id
  58     end
  59
  60     test "respects limit_to_local_content == :all for remote user nicknames" do
  61       Pleroma.Config.put([:instance, :limit_to_local_content], :all)
  62
  63       user = insert(:user, nickname: "user@example.com", local: false)
  64
  65       conn =
  66         build_conn()
  67         |> get("/api/v1/accounts/#{user.nickname}")
  68
  69       assert json_response(conn, 404)
  70     end
  71
  72     test "respects limit_to_local_content == :unauthenticated for remote user nicknames" do
  73       Pleroma.Config.put([:instance, :limit_to_local_content], :unauthenticated)
  74
  75       user = insert(:user, nickname: "user@example.com", local: false)
  76       reading_user = insert(:user)
  77
  78       conn =
  79         build_conn()
  80         |> get("/api/v1/accounts/#{user.nickname}")
  81
  82       assert json_response(conn, 404)
  83
  84       conn =
  85         build_conn()
  86         |> assign(:user, reading_user)
  87         |> assign(:token, insert(:oauth_token, user: reading_user, scopes: ["read:accounts"]))
  88         |> get("/api/v1/accounts/#{user.nickname}")
  89
  90       assert %{"id" => id} = json_response(conn, 200)
  91       assert id == user.id
  92     end
  93
  94     test "accounts fetches correct account for nicknames beginning with numbers", %{conn: conn} do
  95       # Need to set an old-style integer ID to reproduce the problem
  96       # (these are no longer assigned to new accounts but were preserved
  97       # for existing accounts during the migration to flakeIDs)
  98       user_one = insert(:user, %{id: 1212})
  99       user_two = insert(:user, %{nickname: "#{user_one.id}garbage"})
 100
 101       resp_one =
 102         conn
 103         |> get("/api/v1/accounts/#{user_one.id}")
 104
 105       resp_two =
 106         conn
 107         |> get("/api/v1/accounts/#{user_two.nickname}")
 108
 109       resp_three =
 110         conn
 111         |> get("/api/v1/accounts/#{user_two.id}")
 112
 113       acc_one = json_response(resp_one, 200)
 114       acc_two = json_response(resp_two, 200)
 115       acc_three = json_response(resp_three, 200)
 116       refute acc_one == acc_two
 117       assert acc_two == acc_three
 118     end
 119
 120     test "returns 404 when user is invisible", %{conn: conn} do
 121       user = insert(:user, %{invisible: true})
 122
 123       resp =
 124         conn
 125         |> get("/api/v1/accounts/#{user.nickname}")
 126         |> json_response(404)
 127
 128       assert %{"error" => "Can't find user"} = resp
 129     end
 130
 131     test "returns 404 for internal.fetch actor", %{conn: conn} do
 132       %User{nickname: "internal.fetch"} = InternalFetchActor.get_actor()
 133
 134       resp =
 135         conn
 136         |> get("/api/v1/accounts/internal.fetch")
 137         |> json_response(404)
 138
 139       assert %{"error" => "Can't find user"} = resp
 140     end
 141   end
 142
 143   describe "user timelines" do
 144     setup do: oauth_access(["read:statuses"])
 145
 146     test "respects blocks", %{user: user_one, conn: conn} do
 147       user_two = insert(:user)
 148       user_three = insert(:user)
 149
 150       User.block(user_one, user_two)
 151
 152       {:ok, activity} = CommonAPI.post(user_two, %{"status" => "User one sux0rz"})
 153       {:ok, repeat, _} = CommonAPI.repeat(activity.id, user_three)
 154
 155       resp = get(conn, "/api/v1/accounts/#{user_two.id}/statuses")
 156
 157       assert [%{"id" => id}] = json_response(resp, 200)
 158       assert id == activity.id
 159
 160       # Even a blocked user will deliver the full user timeline, there would be
 161       #   no point in looking at a blocked users timeline otherwise
 162       resp = get(conn, "/api/v1/accounts/#{user_two.id}/statuses")
 163
 164       assert [%{"id" => id}] = json_response(resp, 200)
 165       assert id == activity.id
 166
 167       # Third user's timeline includes the repeat when viewed by unauthenticated user
 168       resp = get(build_conn(), "/api/v1/accounts/#{user_three.id}/statuses")
 169       assert [%{"id" => id}] = json_response(resp, 200)
 170       assert id == repeat.id
 171
 172       # When viewing a third user's timeline, the blocked users' statuses will NOT be shown
 173       resp = get(conn, "/api/v1/accounts/#{user_three.id}/statuses")
 174
 175       assert [] = json_response(resp, 200)
 176     end
 177
 178     test "gets users statuses", %{conn: conn} do
 179       user_one = insert(:user)
 180       user_two = insert(:user)
 181       user_three = insert(:user)
 182
 183       {:ok, _user_three} = User.follow(user_three, user_one)
 184
 185       {:ok, activity} = CommonAPI.post(user_one, %{"status" => "HI!!!"})
 186
 187       {:ok, direct_activity} =
 188         CommonAPI.post(user_one, %{
 189           "status" => "Hi, @#{user_two.nickname}.",
 190           "visibility" => "direct"
 191         })
 192
 193       {:ok, private_activity} =
 194         CommonAPI.post(user_one, %{"status" => "private", "visibility" => "private"})
 195
 196       resp = get(conn, "/api/v1/accounts/#{user_one.id}/statuses")
 197
 198       assert [%{"id" => id}] = json_response(resp, 200)
 199       assert id == to_string(activity.id)
 200
 201       resp =
 202         conn
 203         |> assign(:user, user_two)
 204         |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
 205         |> get("/api/v1/accounts/#{user_one.id}/statuses")
 206
 207       assert [%{"id" => id_one}, %{"id" => id_two}] = json_response(resp, 200)
 208       assert id_one == to_string(direct_activity.id)
 209       assert id_two == to_string(activity.id)
 210
 211       resp =
 212         conn
 213         |> assign(:user, user_three)
 214         |> assign(:token, insert(:oauth_token, user: user_three, scopes: ["read:statuses"]))
 215         |> get("/api/v1/accounts/#{user_one.id}/statuses")
 216
 217       assert [%{"id" => id_one}, %{"id" => id_two}] = json_response(resp, 200)
 218       assert id_one == to_string(private_activity.id)
 219       assert id_two == to_string(activity.id)
 220     end
 221
 222     test "unimplemented pinned statuses feature", %{conn: conn} do
 223       note = insert(:note_activity)
 224       user = User.get_cached_by_ap_id(note.data["actor"])
 225
 226       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?pinned=true")
 227
 228       assert json_response(conn, 200) == []
 229     end
 230
 231     test "gets an users media", %{conn: conn} do
 232       note = insert(:note_activity)
 233       user = User.get_cached_by_ap_id(note.data["actor"])
 234
 235       file = %Plug.Upload{
 236         content_type: "image/jpg",
 237         path: Path.absname("test/fixtures/image.jpg"),
 238         filename: "an_image.jpg"
 239       }
 240
 241       {:ok, %{id: media_id}} = ActivityPub.upload(file, actor: user.ap_id)
 242
 243       {:ok, image_post} = CommonAPI.post(user, %{"status" => "cofe", "media_ids" => [media_id]})
 244
 245       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses", %{"only_media" => "true"})
 246
 247       assert [%{"id" => id}] = json_response(conn, 200)
 248       assert id == to_string(image_post.id)
 249
 250       conn = get(build_conn(), "/api/v1/accounts/#{user.id}/statuses", %{"only_media" => "1"})
 251
 252       assert [%{"id" => id}] = json_response(conn, 200)
 253       assert id == to_string(image_post.id)
 254     end
 255
 256     test "gets a user's statuses without reblogs", %{user: user, conn: conn} do
 257       {:ok, post} = CommonAPI.post(user, %{"status" => "HI!!!"})
 258       {:ok, _, _} = CommonAPI.repeat(post.id, user)
 259
 260       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses", %{"exclude_reblogs" => "true"})
 261
 262       assert [%{"id" => id}] = json_response(conn, 200)
 263       assert id == to_string(post.id)
 264
 265       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses", %{"exclude_reblogs" => "1"})
 266
 267       assert [%{"id" => id}] = json_response(conn, 200)
 268       assert id == to_string(post.id)
 269     end
 270
 271     test "filters user's statuses by a hashtag", %{user: user, conn: conn} do
 272       {:ok, post} = CommonAPI.post(user, %{"status" => "#hashtag"})
 273       {:ok, _post} = CommonAPI.post(user, %{"status" => "hashtag"})
 274
 275       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses", %{"tagged" => "hashtag"})
 276
 277       assert [%{"id" => id}] = json_response(conn, 200)
 278       assert id == to_string(post.id)
 279     end
 280
 281     test "the user views their own timelines and excludes direct messages", %{
 282       user: user,
 283       conn: conn
 284     } do
 285       {:ok, public_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "public"})
 286       {:ok, _direct_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "direct"})
 287
 288       conn =
 289         get(conn, "/api/v1/accounts/#{user.id}/statuses", %{"exclude_visibilities" => ["direct"]})
 290
 291       assert [%{"id" => id}] = json_response(conn, 200)
 292       assert id == to_string(public_activity.id)
 293     end
 294   end
 295
 296   describe "followers" do
 297     setup do: oauth_access(["read:accounts"])
 298
 299     test "getting followers", %{user: user, conn: conn} do
 300       other_user = insert(:user)
 301       {:ok, user} = User.follow(user, other_user)
 302
 303       conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")
 304
 305       assert [%{"id" => id}] = json_response(conn, 200)
 306       assert id == to_string(user.id)
 307     end
 308
 309     test "getting followers, hide_followers", %{user: user, conn: conn} do
 310       other_user = insert(:user, hide_followers: true)
 311       {:ok, _user} = User.follow(user, other_user)
 312
 313       conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")
 314
 315       assert [] == json_response(conn, 200)
 316     end
 317
 318     test "getting followers, hide_followers, same user requesting" do
 319       user = insert(:user)
 320       other_user = insert(:user, hide_followers: true)
 321       {:ok, _user} = User.follow(user, other_user)
 322
 323       conn =
 324         build_conn()
 325         |> assign(:user, other_user)
 326         |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
 327         |> get("/api/v1/accounts/#{other_user.id}/followers")
 328
 329       refute [] == json_response(conn, 200)
 330     end
 331
 332     test "getting followers, pagination", %{user: user, conn: conn} do
 333       follower1 = insert(:user)
 334       follower2 = insert(:user)
 335       follower3 = insert(:user)
 336       {:ok, _} = User.follow(follower1, user)
 337       {:ok, _} = User.follow(follower2, user)
 338       {:ok, _} = User.follow(follower3, user)
 339
 340       res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?since_id=#{follower1.id}")
 341
 342       assert [%{"id" => id3}, %{"id" => id2}] = json_response(res_conn, 200)
 343       assert id3 == follower3.id
 344       assert id2 == follower2.id
 345
 346       res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?max_id=#{follower3.id}")
 347
 348       assert [%{"id" => id2}, %{"id" => id1}] = json_response(res_conn, 200)
 349       assert id2 == follower2.id
 350       assert id1 == follower1.id
 351
 352       res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?limit=1&max_id=#{follower3.id}")
 353
 354       assert [%{"id" => id2}] = json_response(res_conn, 200)
 355       assert id2 == follower2.id
 356
 357       assert [link_header] = get_resp_header(res_conn, "link")
 358       assert link_header =~ ~r/min_id=#{follower2.id}/
 359       assert link_header =~ ~r/max_id=#{follower2.id}/
 360     end
 361   end
 362
 363   describe "following" do
 364     setup do: oauth_access(["read:accounts"])
 365
 366     test "getting following", %{user: user, conn: conn} do
 367       other_user = insert(:user)
 368       {:ok, user} = User.follow(user, other_user)
 369
 370       conn = get(conn, "/api/v1/accounts/#{user.id}/following")
 371
 372       assert [%{"id" => id}] = json_response(conn, 200)
 373       assert id == to_string(other_user.id)
 374     end
 375
 376     test "getting following, hide_follows, other user requesting" do
 377       user = insert(:user, hide_follows: true)
 378       other_user = insert(:user)
 379       {:ok, user} = User.follow(user, other_user)
 380
 381       conn =
 382         build_conn()
 383         |> assign(:user, other_user)
 384         |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
 385         |> get("/api/v1/accounts/#{user.id}/following")
 386
 387       assert [] == json_response(conn, 200)
 388     end
 389
 390     test "getting following, hide_follows, same user requesting" do
 391       user = insert(:user, hide_follows: true)
 392       other_user = insert(:user)
 393       {:ok, user} = User.follow(user, other_user)
 394
 395       conn =
 396         build_conn()
 397         |> assign(:user, user)
 398         |> assign(:token, insert(:oauth_token, user: user, scopes: ["read:accounts"]))
 399         |> get("/api/v1/accounts/#{user.id}/following")
 400
 401       refute [] == json_response(conn, 200)
 402     end
 403
 404     test "getting following, pagination", %{user: user, conn: conn} do
 405       following1 = insert(:user)
 406       following2 = insert(:user)
 407       following3 = insert(:user)
 408       {:ok, _} = User.follow(user, following1)
 409       {:ok, _} = User.follow(user, following2)
 410       {:ok, _} = User.follow(user, following3)
 411
 412       res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?since_id=#{following1.id}")
 413
 414       assert [%{"id" => id3}, %{"id" => id2}] = json_response(res_conn, 200)
 415       assert id3 == following3.id
 416       assert id2 == following2.id
 417
 418       res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?max_id=#{following3.id}")
 419
 420       assert [%{"id" => id2}, %{"id" => id1}] = json_response(res_conn, 200)
 421       assert id2 == following2.id
 422       assert id1 == following1.id
 423
 424       res_conn =
 425         get(conn, "/api/v1/accounts/#{user.id}/following?limit=1&max_id=#{following3.id}")
 426
 427       assert [%{"id" => id2}] = json_response(res_conn, 200)
 428       assert id2 == following2.id
 429
 430       assert [link_header] = get_resp_header(res_conn, "link")
 431       assert link_header =~ ~r/min_id=#{following2.id}/
 432       assert link_header =~ ~r/max_id=#{following2.id}/
 433     end
 434   end
 435
 436   describe "follow/unfollow" do
 437     setup do: oauth_access(["follow"])
 438
 439     test "following / unfollowing a user", %{conn: conn} do
 440       other_user = insert(:user)
 441
 442       ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/follow")
 443
 444       assert %{"id" => _id, "following" => true} = json_response(ret_conn, 200)
 445
 446       ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/unfollow")
 447
 448       assert %{"id" => _id, "following" => false} = json_response(ret_conn, 200)
 449
 450       conn = post(conn, "/api/v1/follows", %{"uri" => other_user.nickname})
 451
 452       assert %{"id" => id} = json_response(conn, 200)
 453       assert id == to_string(other_user.id)
 454     end
 455
 456     test "cancelling follow request", %{conn: conn} do
 457       %{id: other_user_id} = insert(:user, %{locked: true})
 458
 459       assert %{"id" => ^other_user_id, "following" => false, "requested" => true} =
 460                conn |> post("/api/v1/accounts/#{other_user_id}/follow") |> json_response(:ok)
 461
 462       assert %{"id" => ^other_user_id, "following" => false, "requested" => false} =
 463                conn |> post("/api/v1/accounts/#{other_user_id}/unfollow") |> json_response(:ok)
 464     end
 465
 466     test "following without reblogs" do
 467       %{conn: conn} = oauth_access(["follow", "read:statuses"])
 468       followed = insert(:user)
 469       other_user = insert(:user)
 470
 471       ret_conn = post(conn, "/api/v1/accounts/#{followed.id}/follow?reblogs=false")
 472
 473       assert %{"showing_reblogs" => false} = json_response(ret_conn, 200)
 474
 475       {:ok, activity} = CommonAPI.post(other_user, %{"status" => "hey"})
 476       {:ok, reblog, _} = CommonAPI.repeat(activity.id, followed)
 477
 478       ret_conn = get(conn, "/api/v1/timelines/home")
 479
 480       assert [] == json_response(ret_conn, 200)
 481
 482       ret_conn = post(conn, "/api/v1/accounts/#{followed.id}/follow?reblogs=true")
 483
 484       assert %{"showing_reblogs" => true} = json_response(ret_conn, 200)
 485
 486       conn = get(conn, "/api/v1/timelines/home")
 487
 488       expected_activity_id = reblog.id
 489       assert [%{"id" => ^expected_activity_id}] = json_response(conn, 200)
 490     end
 491
 492     test "following / unfollowing errors", %{user: user, conn: conn} do
 493       # self follow
 494       conn_res = post(conn, "/api/v1/accounts/#{user.id}/follow")
 495       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 496
 497       # self unfollow
 498       user = User.get_cached_by_id(user.id)
 499       conn_res = post(conn, "/api/v1/accounts/#{user.id}/unfollow")
 500       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 501
 502       # self follow via uri
 503       user = User.get_cached_by_id(user.id)
 504       conn_res = post(conn, "/api/v1/follows", %{"uri" => user.nickname})
 505       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 506
 507       # follow non existing user
 508       conn_res = post(conn, "/api/v1/accounts/doesntexist/follow")
 509       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 510
 511       # follow non existing user via uri
 512       conn_res = post(conn, "/api/v1/follows", %{"uri" => "doesntexist"})
 513       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 514
 515       # unfollow non existing user
 516       conn_res = post(conn, "/api/v1/accounts/doesntexist/unfollow")
 517       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 518     end
 519   end
 520
 521   describe "mute/unmute" do
 522     setup do: oauth_access(["write:mutes"])
 523
 524     test "with notifications", %{conn: conn} do
 525       other_user = insert(:user)
 526
 527       ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/mute")
 528
 529       response = json_response(ret_conn, 200)
 530
 531       assert %{"id" => _id, "muting" => true, "muting_notifications" => true} = response
 532
 533       conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")
 534
 535       response = json_response(conn, 200)
 536       assert %{"id" => _id, "muting" => false, "muting_notifications" => false} = response
 537     end
 538
 539     test "without notifications", %{conn: conn} do
 540       other_user = insert(:user)
 541
 542       ret_conn =
 543         post(conn, "/api/v1/accounts/#{other_user.id}/mute", %{"notifications" => "false"})
 544
 545       response = json_response(ret_conn, 200)
 546
 547       assert %{"id" => _id, "muting" => true, "muting_notifications" => false} = response
 548
 549       conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")
 550
 551       response = json_response(conn, 200)
 552       assert %{"id" => _id, "muting" => false, "muting_notifications" => false} = response
 553     end
 554   end
 555
 556   describe "pinned statuses" do
 557     setup do
 558       user = insert(:user)
 559       {:ok, activity} = CommonAPI.post(user, %{"status" => "HI!!!"})
 560       %{conn: conn} = oauth_access(["read:statuses"], user: user)
 561
 562       [conn: conn, user: user, activity: activity]
 563     end
 564
 565     test "returns pinned statuses", %{conn: conn, user: user, activity: activity} do
 566       {:ok, _} = CommonAPI.pin(activity.id, user)
 567
 568       result =
 569         conn
 570         |> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
 571         |> json_response(200)
 572
 573       id_str = to_string(activity.id)
 574
 575       assert [%{"id" => ^id_str, "pinned" => true}] = result
 576     end
 577   end
 578
 579   test "blocking / unblocking a user" do
 580     %{conn: conn} = oauth_access(["follow"])
 581     other_user = insert(:user)
 582
 583     ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/block")
 584
 585     assert %{"id" => _id, "blocking" => true} = json_response(ret_conn, 200)
 586
 587     conn = post(conn, "/api/v1/accounts/#{other_user.id}/unblock")
 588
 589     assert %{"id" => _id, "blocking" => false} = json_response(conn, 200)
 590   end
 591
 592   describe "create account by app" do
 593     setup do
 594       valid_params = %{
 595         username: "lain",
 596         email: "lain@example.org",
 597         password: "PlzDontHackLain",
 598         agreement: true
 599       }
 600
 601       [valid_params: valid_params]
 602     end
 603
 604     test "Account registration via Application", %{conn: conn} do
 605       conn =
 606         post(conn, "/api/v1/apps", %{
 607           client_name: "client_name",
 608           redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
 609           scopes: "read, write, follow"
 610         })
 611
 612       %{
 613         "client_id" => client_id,
 614         "client_secret" => client_secret,
 615         "id" => _,
 616         "name" => "client_name",
 617         "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
 618         "vapid_key" => _,
 619         "website" => nil
 620       } = json_response(conn, 200)
 621
 622       conn =
 623         post(conn, "/oauth/token", %{
 624           grant_type: "client_credentials",
 625           client_id: client_id,
 626           client_secret: client_secret
 627         })
 628
 629       assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
 630                json_response(conn, 200)
 631
 632       assert token
 633       token_from_db = Repo.get_by(Token, token: token)
 634       assert token_from_db
 635       assert refresh
 636       assert scope == "read write follow"
 637
 638       conn =
 639         build_conn()
 640         |> put_req_header("authorization", "Bearer " <> token)
 641         |> post("/api/v1/accounts", %{
 642           username: "lain",
 643           email: "lain@example.org",
 644           password: "PlzDontHackLain",
 645           bio: "Test Bio",
 646           agreement: true
 647         })
 648
 649       %{
 650         "access_token" => token,
 651         "created_at" => _created_at,
 652         "scope" => _scope,
 653         "token_type" => "Bearer"
 654       } = json_response(conn, 200)
 655
 656       token_from_db = Repo.get_by(Token, token: token)
 657       assert token_from_db
 658       token_from_db = Repo.preload(token_from_db, :user)
 659       assert token_from_db.user
 660
 661       assert token_from_db.user.confirmation_pending
 662     end
 663
 664     test "returns error when user already registred", %{conn: conn, valid_params: valid_params} do
 665       _user = insert(:user, email: "lain@example.org")
 666       app_token = insert(:oauth_token, user: nil)
 667
 668       conn =
 669         conn
 670         |> put_req_header("authorization", "Bearer " <> app_token.token)
 671
 672       res = post(conn, "/api/v1/accounts", valid_params)
 673       assert json_response(res, 400) == %{"error" => "{\"email\":[\"has already been taken\"]}"}
 674     end
 675
 676     clear_config([Pleroma.Plugs.RemoteIp, :enabled])
 677
 678     test "rate limit", %{conn: conn} do
 679       Pleroma.Config.put([Pleroma.Plugs.RemoteIp, :enabled], true)
 680       app_token = insert(:oauth_token, user: nil)
 681
 682       conn =
 683         conn
 684         |> put_req_header("authorization", "Bearer " <> app_token.token)
 685         |> Map.put(:remote_ip, {15, 15, 15, 15})
 686
 687       for i <- 1..5 do
 688         conn =
 689           post(conn, "/api/v1/accounts", %{
 690             username: "#{i}lain",
 691             email: "#{i}lain@example.org",
 692             password: "PlzDontHackLain",
 693             agreement: true
 694           })
 695
 696         %{
 697           "access_token" => token,
 698           "created_at" => _created_at,
 699           "scope" => _scope,
 700           "token_type" => "Bearer"
 701         } = json_response(conn, 200)
 702
 703         token_from_db = Repo.get_by(Token, token: token)
 704         assert token_from_db
 705         token_from_db = Repo.preload(token_from_db, :user)
 706         assert token_from_db.user
 707
 708         assert token_from_db.user.confirmation_pending
 709       end
 710
 711       conn =
 712         post(conn, "/api/v1/accounts", %{
 713           username: "6lain",
 714           email: "6lain@example.org",
 715           password: "PlzDontHackLain",
 716           agreement: true
 717         })
 718
 719       assert json_response(conn, :too_many_requests) == %{"error" => "Throttled"}
 720     end
 721
 722     test "returns bad_request if missing required params", %{
 723       conn: conn,
 724       valid_params: valid_params
 725     } do
 726       app_token = insert(:oauth_token, user: nil)
 727
 728       conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
 729
 730       res = post(conn, "/api/v1/accounts", valid_params)
 731       assert json_response(res, 200)
 732
 733       [{127, 0, 0, 1}, {127, 0, 0, 2}, {127, 0, 0, 3}, {127, 0, 0, 4}]
 734       |> Stream.zip(valid_params)
 735       |> Enum.each(fn {ip, {attr, _}} ->
 736         res =
 737           conn
 738           |> Map.put(:remote_ip, ip)
 739           |> post("/api/v1/accounts", Map.delete(valid_params, attr))
 740           |> json_response(400)
 741
 742         assert res == %{"error" => "Missing parameters"}
 743       end)
 744     end
 745
 746     test "returns forbidden if token is invalid", %{conn: conn, valid_params: valid_params} do
 747       conn = put_req_header(conn, "authorization", "Bearer " <> "invalid-token")
 748
 749       res = post(conn, "/api/v1/accounts", valid_params)
 750       assert json_response(res, 403) == %{"error" => "Invalid credentials"}
 751     end
 752   end
 753
 754   describe "GET /api/v1/accounts/:id/lists - account_lists" do
 755     test "returns lists to which the account belongs" do
 756       %{user: user, conn: conn} = oauth_access(["read:lists"])
 757       other_user = insert(:user)
 758       assert {:ok, %Pleroma.List{} = list} = Pleroma.List.create("Test List", user)
 759       {:ok, %{following: _following}} = Pleroma.List.follow(list, other_user)
 760
 761       res =
 762         conn
 763         |> get("/api/v1/accounts/#{other_user.id}/lists")
 764         |> json_response(200)
 765
 766       assert res == [%{"id" => to_string(list.id), "title" => "Test List"}]
 767     end
 768   end
 769
 770   describe "verify_credentials" do
 771     test "verify_credentials" do
 772       %{user: user, conn: conn} = oauth_access(["read:accounts"])
 773       conn = get(conn, "/api/v1/accounts/verify_credentials")
 774
 775       response = json_response(conn, 200)
 776
 777       assert %{"id" => id, "source" => %{"privacy" => "public"}} = response
 778       assert response["pleroma"]["chat_token"]
 779       assert id == to_string(user.id)
 780     end
 781
 782     test "verify_credentials default scope unlisted" do
 783       user = insert(:user, default_scope: "unlisted")
 784       %{conn: conn} = oauth_access(["read:accounts"], user: user)
 785
 786       conn = get(conn, "/api/v1/accounts/verify_credentials")
 787
 788       assert %{"id" => id, "source" => %{"privacy" => "unlisted"}} = json_response(conn, 200)
 789       assert id == to_string(user.id)
 790     end
 791
 792     test "locked accounts" do
 793       user = insert(:user, default_scope: "private")
 794       %{conn: conn} = oauth_access(["read:accounts"], user: user)
 795
 796       conn = get(conn, "/api/v1/accounts/verify_credentials")
 797
 798       assert %{"id" => id, "source" => %{"privacy" => "private"}} = json_response(conn, 200)
 799       assert id == to_string(user.id)
 800     end
 801   end
 802
 803   describe "user relationships" do
 804     setup do: oauth_access(["read:follows"])
 805
 806     test "returns the relationships for the current user", %{user: user, conn: conn} do
 807       other_user = insert(:user)
 808       {:ok, _user} = User.follow(user, other_user)
 809
 810       conn = get(conn, "/api/v1/accounts/relationships", %{"id" => [other_user.id]})
 811
 812       assert [relationship] = json_response(conn, 200)
 813
 814       assert to_string(other_user.id) == relationship["id"]
 815     end
 816
 817     test "returns an empty list on a bad request", %{conn: conn} do
 818       conn = get(conn, "/api/v1/accounts/relationships", %{})
 819
 820       assert [] = json_response(conn, 200)
 821     end
 822   end
 823
 824   test "getting a list of mutes" do
 825     %{user: user, conn: conn} = oauth_access(["read:mutes"])
 826     other_user = insert(:user)
 827
 828     {:ok, _user_relationships} = User.mute(user, other_user)
 829
 830     conn = get(conn, "/api/v1/mutes")
 831
 832     other_user_id = to_string(other_user.id)
 833     assert [%{"id" => ^other_user_id}] = json_response(conn, 200)
 834   end
 835
 836   test "getting a list of blocks" do
 837     %{user: user, conn: conn} = oauth_access(["read:blocks"])
 838     other_user = insert(:user)
 839
 840     {:ok, _user_relationship} = User.block(user, other_user)
 841
 842     conn =
 843       conn
 844       |> assign(:user, user)
 845       |> get("/api/v1/blocks")
 846
 847     other_user_id = to_string(other_user.id)
 848     assert [%{"id" => ^other_user_id}] = json_response(conn, 200)
 849   end
 850 end