1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Web.MastodonAPI.AccountControllerTest do
6 use Pleroma.Web.ConnCase
10 alias Pleroma.Web.ActivityPub.ActivityPub
11 alias Pleroma.Web.CommonAPI
12 alias Pleroma.Web.OAuth.Token
14 import Pleroma.Factory
16 describe "account fetching" do
22 |> get("/api/v1/accounts/#{user.id}")
24 assert %{"id" => id} = json_response(conn, 200)
25 assert id == to_string(user.id)
29 |> get("/api/v1/accounts/-1")
31 assert %{"error" => "Can't find user"} = json_response(conn, 404)
34 test "works by nickname" do
39 |> get("/api/v1/accounts/#{user.nickname}")
41 assert %{"id" => id} = json_response(conn, 200)
45 test "works by nickname for remote users" do
46 limit_to_local = Pleroma.Config.get([:instance, :limit_to_local_content])
47 Pleroma.Config.put([:instance, :limit_to_local_content], false)
48 user = insert(:user, nickname: "user@example.com", local: false)
52 |> get("/api/v1/accounts/#{user.nickname}")
54 Pleroma.Config.put([:instance, :limit_to_local_content], limit_to_local)
55 assert %{"id" => id} = json_response(conn, 200)
59 test "respects limit_to_local_content == :all for remote user nicknames" do
60 limit_to_local = Pleroma.Config.get([:instance, :limit_to_local_content])
61 Pleroma.Config.put([:instance, :limit_to_local_content], :all)
63 user = insert(:user, nickname: "user@example.com", local: false)
67 |> get("/api/v1/accounts/#{user.nickname}")
69 Pleroma.Config.put([:instance, :limit_to_local_content], limit_to_local)
70 assert json_response(conn, 404)
73 test "respects limit_to_local_content == :unauthenticated for remote user nicknames" do
74 limit_to_local = Pleroma.Config.get([:instance, :limit_to_local_content])
75 Pleroma.Config.put([:instance, :limit_to_local_content], :unauthenticated)
77 user = insert(:user, nickname: "user@example.com", local: false)
78 reading_user = insert(:user)
82 |> get("/api/v1/accounts/#{user.nickname}")
84 assert json_response(conn, 404)
88 |> assign(:user, reading_user)
89 |> get("/api/v1/accounts/#{user.nickname}")
91 Pleroma.Config.put([:instance, :limit_to_local_content], limit_to_local)
92 assert %{"id" => id} = json_response(conn, 200)
96 test "accounts fetches correct account for nicknames beginning with numbers", %{conn: conn} do
97 # Need to set an old-style integer ID to reproduce the problem
98 # (these are no longer assigned to new accounts but were preserved
99 # for existing accounts during the migration to flakeIDs)
100 user_one = insert(:user, %{id: 1212})
101 user_two = insert(:user, %{nickname: "#{user_one.id}garbage"})
105 |> get("/api/v1/accounts/#{user_one.id}")
109 |> get("/api/v1/accounts/#{user_two.nickname}")
113 |> get("/api/v1/accounts/#{user_two.id}")
115 acc_one = json_response(resp_one, 200)
116 acc_two = json_response(resp_two, 200)
117 acc_three = json_response(resp_three, 200)
118 refute acc_one == acc_two
119 assert acc_two == acc_three
123 describe "user timelines" do
124 test "gets a users statuses", %{conn: conn} do
125 user_one = insert(:user)
126 user_two = insert(:user)
127 user_three = insert(:user)
129 {:ok, user_three} = User.follow(user_three, user_one)
131 {:ok, activity} = CommonAPI.post(user_one, %{"status" => "HI!!!"})
133 {:ok, direct_activity} =
134 CommonAPI.post(user_one, %{
135 "status" => "Hi, @#{user_two.nickname}.",
136 "visibility" => "direct"
139 {:ok, private_activity} =
140 CommonAPI.post(user_one, %{"status" => "private", "visibility" => "private"})
144 |> get("/api/v1/accounts/#{user_one.id}/statuses")
146 assert [%{"id" => id}] = json_response(resp, 200)
147 assert id == to_string(activity.id)
151 |> assign(:user, user_two)
152 |> get("/api/v1/accounts/#{user_one.id}/statuses")
154 assert [%{"id" => id_one}, %{"id" => id_two}] = json_response(resp, 200)
155 assert id_one == to_string(direct_activity.id)
156 assert id_two == to_string(activity.id)
160 |> assign(:user, user_three)
161 |> get("/api/v1/accounts/#{user_one.id}/statuses")
163 assert [%{"id" => id_one}, %{"id" => id_two}] = json_response(resp, 200)
164 assert id_one == to_string(private_activity.id)
165 assert id_two == to_string(activity.id)
168 test "unimplemented pinned statuses feature", %{conn: conn} do
169 note = insert(:note_activity)
170 user = User.get_cached_by_ap_id(note.data["actor"])
174 |> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
176 assert json_response(conn, 200) == []
179 test "gets an users media", %{conn: conn} do
180 note = insert(:note_activity)
181 user = User.get_cached_by_ap_id(note.data["actor"])
184 content_type: "image/jpg",
185 path: Path.absname("test/fixtures/image.jpg"),
186 filename: "an_image.jpg"
189 {:ok, %{id: media_id}} = ActivityPub.upload(file, actor: user.ap_id)
191 {:ok, image_post} = CommonAPI.post(user, %{"status" => "cofe", "media_ids" => [media_id]})
195 |> get("/api/v1/accounts/#{user.id}/statuses", %{"only_media" => "true"})
197 assert [%{"id" => id}] = json_response(conn, 200)
198 assert id == to_string(image_post.id)
202 |> get("/api/v1/accounts/#{user.id}/statuses", %{"only_media" => "1"})
204 assert [%{"id" => id}] = json_response(conn, 200)
205 assert id == to_string(image_post.id)
208 test "gets a user's statuses without reblogs", %{conn: conn} do
210 {:ok, post} = CommonAPI.post(user, %{"status" => "HI!!!"})
211 {:ok, _, _} = CommonAPI.repeat(post.id, user)
215 |> get("/api/v1/accounts/#{user.id}/statuses", %{"exclude_reblogs" => "true"})
217 assert [%{"id" => id}] = json_response(conn, 200)
218 assert id == to_string(post.id)
222 |> get("/api/v1/accounts/#{user.id}/statuses", %{"exclude_reblogs" => "1"})
224 assert [%{"id" => id}] = json_response(conn, 200)
225 assert id == to_string(post.id)
228 test "filters user's statuses by a hashtag", %{conn: conn} do
230 {:ok, post} = CommonAPI.post(user, %{"status" => "#hashtag"})
231 {:ok, _post} = CommonAPI.post(user, %{"status" => "hashtag"})
235 |> get("/api/v1/accounts/#{user.id}/statuses", %{"tagged" => "hashtag"})
237 assert [%{"id" => id}] = json_response(conn, 200)
238 assert id == to_string(post.id)
241 test "the user views their own timelines and excludes direct messages", %{conn: conn} do
243 {:ok, public_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "public"})
244 {:ok, _direct_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "direct"})
248 |> assign(:user, user)
249 |> get("/api/v1/accounts/#{user.id}/statuses", %{"exclude_visibilities" => ["direct"]})
251 assert [%{"id" => id}] = json_response(conn, 200)
252 assert id == to_string(public_activity.id)
256 describe "followers" do
257 test "getting followers", %{conn: conn} do
259 other_user = insert(:user)
260 {:ok, user} = User.follow(user, other_user)
264 |> get("/api/v1/accounts/#{other_user.id}/followers")
266 assert [%{"id" => id}] = json_response(conn, 200)
267 assert id == to_string(user.id)
270 test "getting followers, hide_followers", %{conn: conn} do
272 other_user = insert(:user, hide_followers: true)
273 {:ok, _user} = User.follow(user, other_user)
277 |> get("/api/v1/accounts/#{other_user.id}/followers")
279 assert [] == json_response(conn, 200)
282 test "getting followers, hide_followers, same user requesting", %{conn: conn} do
284 other_user = insert(:user, hide_followers: true)
285 {:ok, _user} = User.follow(user, other_user)
289 |> assign(:user, other_user)
290 |> get("/api/v1/accounts/#{other_user.id}/followers")
292 refute [] == json_response(conn, 200)
295 test "getting followers, pagination", %{conn: conn} do
297 follower1 = insert(:user)
298 follower2 = insert(:user)
299 follower3 = insert(:user)
300 {:ok, _} = User.follow(follower1, user)
301 {:ok, _} = User.follow(follower2, user)
302 {:ok, _} = User.follow(follower3, user)
306 |> assign(:user, user)
310 |> get("/api/v1/accounts/#{user.id}/followers?since_id=#{follower1.id}")
312 assert [%{"id" => id3}, %{"id" => id2}] = json_response(res_conn, 200)
313 assert id3 == follower3.id
314 assert id2 == follower2.id
318 |> get("/api/v1/accounts/#{user.id}/followers?max_id=#{follower3.id}")
320 assert [%{"id" => id2}, %{"id" => id1}] = json_response(res_conn, 200)
321 assert id2 == follower2.id
322 assert id1 == follower1.id
326 |> get("/api/v1/accounts/#{user.id}/followers?limit=1&max_id=#{follower3.id}")
328 assert [%{"id" => id2}] = json_response(res_conn, 200)
329 assert id2 == follower2.id
331 assert [link_header] = get_resp_header(res_conn, "link")
332 assert link_header =~ ~r/min_id=#{follower2.id}/
333 assert link_header =~ ~r/max_id=#{follower2.id}/
337 describe "following" do
338 test "getting following", %{conn: conn} do
340 other_user = insert(:user)
341 {:ok, user} = User.follow(user, other_user)
345 |> get("/api/v1/accounts/#{user.id}/following")
347 assert [%{"id" => id}] = json_response(conn, 200)
348 assert id == to_string(other_user.id)
351 test "getting following, hide_follows", %{conn: conn} do
352 user = insert(:user, hide_follows: true)
353 other_user = insert(:user)
354 {:ok, user} = User.follow(user, other_user)
358 |> get("/api/v1/accounts/#{user.id}/following")
360 assert [] == json_response(conn, 200)
363 test "getting following, hide_follows, same user requesting", %{conn: conn} do
364 user = insert(:user, hide_follows: true)
365 other_user = insert(:user)
366 {:ok, user} = User.follow(user, other_user)
370 |> assign(:user, user)
371 |> get("/api/v1/accounts/#{user.id}/following")
373 refute [] == json_response(conn, 200)
376 test "getting following, pagination", %{conn: conn} do
378 following1 = insert(:user)
379 following2 = insert(:user)
380 following3 = insert(:user)
381 {:ok, _} = User.follow(user, following1)
382 {:ok, _} = User.follow(user, following2)
383 {:ok, _} = User.follow(user, following3)
387 |> assign(:user, user)
391 |> get("/api/v1/accounts/#{user.id}/following?since_id=#{following1.id}")
393 assert [%{"id" => id3}, %{"id" => id2}] = json_response(res_conn, 200)
394 assert id3 == following3.id
395 assert id2 == following2.id
399 |> get("/api/v1/accounts/#{user.id}/following?max_id=#{following3.id}")
401 assert [%{"id" => id2}, %{"id" => id1}] = json_response(res_conn, 200)
402 assert id2 == following2.id
403 assert id1 == following1.id
407 |> get("/api/v1/accounts/#{user.id}/following?limit=1&max_id=#{following3.id}")
409 assert [%{"id" => id2}] = json_response(res_conn, 200)
410 assert id2 == following2.id
412 assert [link_header] = get_resp_header(res_conn, "link")
413 assert link_header =~ ~r/min_id=#{following2.id}/
414 assert link_header =~ ~r/max_id=#{following2.id}/
418 describe "follow/unfollow" do
419 test "following / unfollowing a user", %{conn: conn} do
421 other_user = insert(:user)
425 |> assign(:user, user)
426 |> post("/api/v1/accounts/#{other_user.id}/follow")
428 assert %{"id" => _id, "following" => true} = json_response(conn, 200)
430 user = User.get_cached_by_id(user.id)
434 |> assign(:user, user)
435 |> post("/api/v1/accounts/#{other_user.id}/unfollow")
437 assert %{"id" => _id, "following" => false} = json_response(conn, 200)
439 user = User.get_cached_by_id(user.id)
443 |> assign(:user, user)
444 |> post("/api/v1/follows", %{"uri" => other_user.nickname})
446 assert %{"id" => id} = json_response(conn, 200)
447 assert id == to_string(other_user.id)
450 test "following without reblogs" do
451 follower = insert(:user)
452 followed = insert(:user)
453 other_user = insert(:user)
457 |> assign(:user, follower)
458 |> post("/api/v1/accounts/#{followed.id}/follow?reblogs=false")
460 assert %{"showing_reblogs" => false} = json_response(conn, 200)
462 {:ok, activity} = CommonAPI.post(other_user, %{"status" => "hey"})
463 {:ok, reblog, _} = CommonAPI.repeat(activity.id, followed)
467 |> assign(:user, User.get_cached_by_id(follower.id))
468 |> get("/api/v1/timelines/home")
470 assert [] == json_response(conn, 200)
474 |> assign(:user, User.get_cached_by_id(follower.id))
475 |> post("/api/v1/accounts/#{followed.id}/follow?reblogs=true")
477 assert %{"showing_reblogs" => true} = json_response(conn, 200)
481 |> assign(:user, User.get_cached_by_id(follower.id))
482 |> get("/api/v1/timelines/home")
484 expected_activity_id = reblog.id
485 assert [%{"id" => ^expected_activity_id}] = json_response(conn, 200)
488 test "following / unfollowing errors" do
493 |> assign(:user, user)
496 conn_res = post(conn, "/api/v1/accounts/#{user.id}/follow")
497 assert %{"error" => "Record not found"} = json_response(conn_res, 404)
500 user = User.get_cached_by_id(user.id)
501 conn_res = post(conn, "/api/v1/accounts/#{user.id}/unfollow")
502 assert %{"error" => "Record not found"} = json_response(conn_res, 404)
504 # self follow via uri
505 user = User.get_cached_by_id(user.id)
506 conn_res = post(conn, "/api/v1/follows", %{"uri" => user.nickname})
507 assert %{"error" => "Record not found"} = json_response(conn_res, 404)
509 # follow non existing user
510 conn_res = post(conn, "/api/v1/accounts/doesntexist/follow")
511 assert %{"error" => "Record not found"} = json_response(conn_res, 404)
513 # follow non existing user via uri
514 conn_res = post(conn, "/api/v1/follows", %{"uri" => "doesntexist"})
515 assert %{"error" => "Record not found"} = json_response(conn_res, 404)
517 # unfollow non existing user
518 conn_res = post(conn, "/api/v1/accounts/doesntexist/unfollow")
519 assert %{"error" => "Record not found"} = json_response(conn_res, 404)
523 describe "mute/unmute" do
524 test "with notifications", %{conn: conn} do
526 other_user = insert(:user)
530 |> assign(:user, user)
531 |> post("/api/v1/accounts/#{other_user.id}/mute")
533 response = json_response(conn, 200)
535 assert %{"id" => _id, "muting" => true, "muting_notifications" => true} = response
536 user = User.get_cached_by_id(user.id)
540 |> assign(:user, user)
541 |> post("/api/v1/accounts/#{other_user.id}/unmute")
543 response = json_response(conn, 200)
544 assert %{"id" => _id, "muting" => false, "muting_notifications" => false} = response
547 test "without notifications", %{conn: conn} do
549 other_user = insert(:user)
553 |> assign(:user, user)
554 |> post("/api/v1/accounts/#{other_user.id}/mute", %{"notifications" => "false"})
556 response = json_response(conn, 200)
558 assert %{"id" => _id, "muting" => true, "muting_notifications" => false} = response
559 user = User.get_cached_by_id(user.id)
563 |> assign(:user, user)
564 |> post("/api/v1/accounts/#{other_user.id}/unmute")
566 response = json_response(conn, 200)
567 assert %{"id" => _id, "muting" => false, "muting_notifications" => false} = response
571 describe "pinned statuses" do
574 {:ok, activity} = CommonAPI.post(user, %{"status" => "HI!!!"})
576 [user: user, activity: activity]
579 test "returns pinned statuses", %{conn: conn, user: user, activity: activity} do
580 {:ok, _} = CommonAPI.pin(activity.id, user)
584 |> assign(:user, user)
585 |> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
586 |> json_response(200)
588 id_str = to_string(activity.id)
590 assert [%{"id" => ^id_str, "pinned" => true}] = result
594 test "blocking / unblocking a user", %{conn: conn} do
596 other_user = insert(:user)
600 |> assign(:user, user)
601 |> post("/api/v1/accounts/#{other_user.id}/block")
603 assert %{"id" => _id, "blocking" => true} = json_response(conn, 200)
605 user = User.get_cached_by_id(user.id)
609 |> assign(:user, user)
610 |> post("/api/v1/accounts/#{other_user.id}/unblock")
612 assert %{"id" => _id, "blocking" => false} = json_response(conn, 200)
615 describe "create account by app" do
619 email: "lain@example.org",
620 password: "PlzDontHackLain",
624 [valid_params: valid_params]
627 test "Account registration via Application", %{conn: conn} do
630 |> post("/api/v1/apps", %{
631 client_name: "client_name",
632 redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
633 scopes: "read, write, follow"
637 "client_id" => client_id,
638 "client_secret" => client_secret,
640 "name" => "client_name",
641 "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
644 } = json_response(conn, 200)
648 |> post("/oauth/token", %{
649 grant_type: "client_credentials",
650 client_id: client_id,
651 client_secret: client_secret
654 assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
655 json_response(conn, 200)
658 token_from_db = Repo.get_by(Token, token: token)
661 assert scope == "read write follow"
665 |> put_req_header("authorization", "Bearer " <> token)
666 |> post("/api/v1/accounts", %{
668 email: "lain@example.org",
669 password: "PlzDontHackLain",
675 "access_token" => token,
676 "created_at" => _created_at,
678 "token_type" => "Bearer"
679 } = json_response(conn, 200)
681 token_from_db = Repo.get_by(Token, token: token)
683 token_from_db = Repo.preload(token_from_db, :user)
684 assert token_from_db.user
686 assert token_from_db.user.confirmation_pending
689 test "returns error when user already registred", %{conn: conn, valid_params: valid_params} do
690 _user = insert(:user, email: "lain@example.org")
691 app_token = insert(:oauth_token, user: nil)
695 |> put_req_header("authorization", "Bearer " <> app_token.token)
697 res = post(conn, "/api/v1/accounts", valid_params)
698 assert json_response(res, 400) == %{"error" => "{\"email\":[\"has already been taken\"]}"}
701 test "rate limit", %{conn: conn} do
702 app_token = insert(:oauth_token, user: nil)
705 put_req_header(conn, "authorization", "Bearer " <> app_token.token)
706 |> Map.put(:remote_ip, {15, 15, 15, 15})
711 |> post("/api/v1/accounts", %{
712 username: "#{i}lain",
713 email: "#{i}lain@example.org",
714 password: "PlzDontHackLain",
719 "access_token" => token,
720 "created_at" => _created_at,
722 "token_type" => "Bearer"
723 } = json_response(conn, 200)
725 token_from_db = Repo.get_by(Token, token: token)
727 token_from_db = Repo.preload(token_from_db, :user)
728 assert token_from_db.user
730 assert token_from_db.user.confirmation_pending
735 |> post("/api/v1/accounts", %{
737 email: "6lain@example.org",
738 password: "PlzDontHackLain",
742 assert json_response(conn, :too_many_requests) == %{"error" => "Throttled"}
745 test "returns bad_request if missing required params", %{
747 valid_params: valid_params
749 app_token = insert(:oauth_token, user: nil)
753 |> put_req_header("authorization", "Bearer " <> app_token.token)
755 res = post(conn, "/api/v1/accounts", valid_params)
756 assert json_response(res, 200)
758 [{127, 0, 0, 1}, {127, 0, 0, 2}, {127, 0, 0, 3}, {127, 0, 0, 4}]
759 |> Stream.zip(valid_params)
760 |> Enum.each(fn {ip, {attr, _}} ->
763 |> Map.put(:remote_ip, ip)
764 |> post("/api/v1/accounts", Map.delete(valid_params, attr))
765 |> json_response(400)
767 assert res == %{"error" => "Missing parameters"}
771 test "returns forbidden if token is invalid", %{conn: conn, valid_params: valid_params} do
774 |> put_req_header("authorization", "Bearer " <> "invalid-token")
776 res = post(conn, "/api/v1/accounts", valid_params)
777 assert json_response(res, 403) == %{"error" => "Invalid credentials"}
781 describe "GET /api/v1/accounts/:id/lists - account_lists" do
782 test "returns lists to which the account belongs", %{conn: conn} do
784 other_user = insert(:user)
785 assert {:ok, %Pleroma.List{} = list} = Pleroma.List.create("Test List", user)
786 {:ok, %{following: _following}} = Pleroma.List.follow(list, other_user)
790 |> assign(:user, user)
791 |> get("/api/v1/accounts/#{other_user.id}/lists")
792 |> json_response(200)
794 assert res == [%{"id" => to_string(list.id), "title" => "Test List"}]
798 describe "verify_credentials" do
799 test "verify_credentials", %{conn: conn} do
804 |> assign(:user, user)
805 |> get("/api/v1/accounts/verify_credentials")
807 response = json_response(conn, 200)
809 assert %{"id" => id, "source" => %{"privacy" => "public"}} = response
810 assert response["pleroma"]["chat_token"]
811 assert id == to_string(user.id)
814 test "verify_credentials default scope unlisted", %{conn: conn} do
815 user = insert(:user, default_scope: "unlisted")
819 |> assign(:user, user)
820 |> get("/api/v1/accounts/verify_credentials")
822 assert %{"id" => id, "source" => %{"privacy" => "unlisted"}} = json_response(conn, 200)
823 assert id == to_string(user.id)
826 test "locked accounts", %{conn: conn} do
827 user = insert(:user, default_scope: "private")
831 |> assign(:user, user)
832 |> get("/api/v1/accounts/verify_credentials")
834 assert %{"id" => id, "source" => %{"privacy" => "private"}} = json_response(conn, 200)
835 assert id == to_string(user.id)
839 describe "user relationships" do
840 test "returns the relationships for the current user", %{conn: conn} do
842 other_user = insert(:user)
843 {:ok, user} = User.follow(user, other_user)
847 |> assign(:user, user)
848 |> get("/api/v1/accounts/relationships", %{"id" => [other_user.id]})
850 assert [relationship] = json_response(conn, 200)
852 assert to_string(other_user.id) == relationship["id"]
855 test "returns an empty list on a bad request", %{conn: conn} do
860 |> assign(:user, user)
861 |> get("/api/v1/accounts/relationships", %{})
863 assert [] = json_response(conn, 200)
867 test "getting a list of mutes", %{conn: conn} do
869 other_user = insert(:user)
871 {:ok, user} = User.mute(user, other_user)
875 |> assign(:user, user)
876 |> get("/api/v1/mutes")
878 other_user_id = to_string(other_user.id)
879 assert [%{"id" => ^other_user_id}] = json_response(conn, 200)
882 test "getting a list of blocks", %{conn: conn} do
884 other_user = insert(:user)
886 {:ok, user} = User.block(user, other_user)
890 |> assign(:user, user)
891 |> get("/api/v1/blocks")
893 other_user_id = to_string(other_user.id)
894 assert [%{"id" => ^other_user_id}] = json_response(conn, 200)