git.squeep.com Git - akkoma/blob - test/web/mastodon_api/controllers/account_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.AccountControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   alias Pleroma.Config
   9   alias Pleroma.Repo
  10   alias Pleroma.User
  11   alias Pleroma.Web.ActivityPub.ActivityPub
  12   alias Pleroma.Web.ActivityPub.InternalFetchActor
  13   alias Pleroma.Web.ApiSpec
  14   alias Pleroma.Web.CommonAPI
  15   alias Pleroma.Web.OAuth.Token
  16
  17   import OpenApiSpex.TestAssertions
  18   import Pleroma.Factory
  19
  20   describe "account fetching" do
  21     setup do: clear_config([:instance, :limit_to_local_content])
  22
  23     test "works by id" do
  24       user = insert(:user)
  25
  26       conn =
  27         build_conn()
  28         |> get("/api/v1/accounts/#{user.id}")
  29
  30       assert %{"id" => id} = json_response(conn, 200)
  31       assert id == to_string(user.id)
  32
  33       conn =
  34         build_conn()
  35         |> get("/api/v1/accounts/-1")
  36
  37       assert %{"error" => "Can't find user"} = json_response(conn, 404)
  38     end
  39
  40     test "works by nickname" do
  41       user = insert(:user)
  42
  43       conn =
  44         build_conn()
  45         |> get("/api/v1/accounts/#{user.nickname}")
  46
  47       assert %{"id" => id} = json_response(conn, 200)
  48       assert id == user.id
  49     end
  50
  51     test "works by nickname for remote users" do
  52       Config.put([:instance, :limit_to_local_content], false)
  53       user = insert(:user, nickname: "user@example.com", local: false)
  54
  55       conn =
  56         build_conn()
  57         |> get("/api/v1/accounts/#{user.nickname}")
  58
  59       assert %{"id" => id} = json_response(conn, 200)
  60       assert id == user.id
  61     end
  62
  63     test "respects limit_to_local_content == :all for remote user nicknames" do
  64       Config.put([:instance, :limit_to_local_content], :all)
  65
  66       user = insert(:user, nickname: "user@example.com", local: false)
  67
  68       conn =
  69         build_conn()
  70         |> get("/api/v1/accounts/#{user.nickname}")
  71
  72       assert json_response(conn, 404)
  73     end
  74
  75     test "respects limit_to_local_content == :unauthenticated for remote user nicknames" do
  76       Config.put([:instance, :limit_to_local_content], :unauthenticated)
  77
  78       user = insert(:user, nickname: "user@example.com", local: false)
  79       reading_user = insert(:user)
  80
  81       conn =
  82         build_conn()
  83         |> get("/api/v1/accounts/#{user.nickname}")
  84
  85       assert json_response(conn, 404)
  86
  87       conn =
  88         build_conn()
  89         |> assign(:user, reading_user)
  90         |> assign(:token, insert(:oauth_token, user: reading_user, scopes: ["read:accounts"]))
  91         |> get("/api/v1/accounts/#{user.nickname}")
  92
  93       assert %{"id" => id} = json_response(conn, 200)
  94       assert id == user.id
  95     end
  96
  97     test "accounts fetches correct account for nicknames beginning with numbers", %{conn: conn} do
  98       # Need to set an old-style integer ID to reproduce the problem
  99       # (these are no longer assigned to new accounts but were preserved
 100       # for existing accounts during the migration to flakeIDs)
 101       user_one = insert(:user, %{id: 1212})
 102       user_two = insert(:user, %{nickname: "#{user_one.id}garbage"})
 103
 104       resp_one =
 105         conn
 106         |> get("/api/v1/accounts/#{user_one.id}")
 107
 108       resp_two =
 109         conn
 110         |> get("/api/v1/accounts/#{user_two.nickname}")
 111
 112       resp_three =
 113         conn
 114         |> get("/api/v1/accounts/#{user_two.id}")
 115
 116       acc_one = json_response(resp_one, 200)
 117       acc_two = json_response(resp_two, 200)
 118       acc_three = json_response(resp_three, 200)
 119       refute acc_one == acc_two
 120       assert acc_two == acc_three
 121     end
 122
 123     test "returns 404 when user is invisible", %{conn: conn} do
 124       user = insert(:user, %{invisible: true})
 125
 126       resp =
 127         conn
 128         |> get("/api/v1/accounts/#{user.nickname}")
 129         |> json_response(404)
 130
 131       assert %{"error" => "Can't find user"} = resp
 132     end
 133
 134     test "returns 404 for internal.fetch actor", %{conn: conn} do
 135       %User{nickname: "internal.fetch"} = InternalFetchActor.get_actor()
 136
 137       resp =
 138         conn
 139         |> get("/api/v1/accounts/internal.fetch")
 140         |> json_response(404)
 141
 142       assert %{"error" => "Can't find user"} = resp
 143     end
 144   end
 145
 146   defp local_and_remote_users do
 147     local = insert(:user)
 148     remote = insert(:user, local: false)
 149     {:ok, local: local, remote: remote}
 150   end
 151
 152   describe "user fetching with restrict unauthenticated profiles for local and remote" do
 153     setup do: local_and_remote_users()
 154
 155     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 156
 157     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 158
 159     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 160       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 161
 162       assert json_response(res_conn, :not_found) == %{
 163                "error" => "Can't find user"
 164              }
 165
 166       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 167
 168       assert json_response(res_conn, :not_found) == %{
 169                "error" => "Can't find user"
 170              }
 171     end
 172
 173     test "if user is authenticated", %{local: local, remote: remote} do
 174       %{conn: conn} = oauth_access(["read"])
 175
 176       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 177       assert %{"id" => _} = json_response(res_conn, 200)
 178
 179       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 180       assert %{"id" => _} = json_response(res_conn, 200)
 181     end
 182   end
 183
 184   describe "user fetching with restrict unauthenticated profiles for local" do
 185     setup do: local_and_remote_users()
 186
 187     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 188
 189     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 190       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 191
 192       assert json_response(res_conn, :not_found) == %{
 193                "error" => "Can't find user"
 194              }
 195
 196       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 197       assert %{"id" => _} = json_response(res_conn, 200)
 198     end
 199
 200     test "if user is authenticated", %{local: local, remote: remote} do
 201       %{conn: conn} = oauth_access(["read"])
 202
 203       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 204       assert %{"id" => _} = json_response(res_conn, 200)
 205
 206       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 207       assert %{"id" => _} = json_response(res_conn, 200)
 208     end
 209   end
 210
 211   describe "user fetching with restrict unauthenticated profiles for remote" do
 212     setup do: local_and_remote_users()
 213
 214     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 215
 216     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 217       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 218       assert %{"id" => _} = json_response(res_conn, 200)
 219
 220       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 221
 222       assert json_response(res_conn, :not_found) == %{
 223                "error" => "Can't find user"
 224              }
 225     end
 226
 227     test "if user is authenticated", %{local: local, remote: remote} do
 228       %{conn: conn} = oauth_access(["read"])
 229
 230       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 231       assert %{"id" => _} = json_response(res_conn, 200)
 232
 233       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 234       assert %{"id" => _} = json_response(res_conn, 200)
 235     end
 236   end
 237
 238   describe "user timelines" do
 239     setup do: oauth_access(["read:statuses"])
 240
 241     test "respects blocks", %{user: user_one, conn: conn} do
 242       user_two = insert(:user)
 243       user_three = insert(:user)
 244
 245       User.block(user_one, user_two)
 246
 247       {:ok, activity} = CommonAPI.post(user_two, %{"status" => "User one sux0rz"})
 248       {:ok, repeat, _} = CommonAPI.repeat(activity.id, user_three)
 249
 250       assert resp = get(conn, "/api/v1/accounts/#{user_two.id}/statuses") |> json_response(200)
 251       assert [%{"id" => id}] = resp
 252       assert_schema(resp, "StatusesResponse", ApiSpec.spec())
 253       assert id == activity.id
 254
 255       # Even a blocked user will deliver the full user timeline, there would be
 256       #   no point in looking at a blocked users timeline otherwise
 257       assert resp = get(conn, "/api/v1/accounts/#{user_two.id}/statuses") |> json_response(200)
 258       assert [%{"id" => id}] = resp
 259       assert id == activity.id
 260       assert_schema(resp, "StatusesResponse", ApiSpec.spec())
 261
 262       # Third user's timeline includes the repeat when viewed by unauthenticated user
 263       resp = get(build_conn(), "/api/v1/accounts/#{user_three.id}/statuses") |> json_response(200)
 264       assert [%{"id" => id}] = resp
 265       assert id == repeat.id
 266       assert_schema(resp, "StatusesResponse", ApiSpec.spec())
 267
 268       # When viewing a third user's timeline, the blocked users' statuses will NOT be shown
 269       resp = get(conn, "/api/v1/accounts/#{user_three.id}/statuses")
 270
 271       assert [] = json_response(resp, 200)
 272     end
 273
 274     test "gets users statuses", %{conn: conn} do
 275       user_one = insert(:user)
 276       user_two = insert(:user)
 277       user_three = insert(:user)
 278
 279       {:ok, _user_three} = User.follow(user_three, user_one)
 280
 281       {:ok, activity} = CommonAPI.post(user_one, %{"status" => "HI!!!"})
 282
 283       {:ok, direct_activity} =
 284         CommonAPI.post(user_one, %{
 285           "status" => "Hi, @#{user_two.nickname}.",
 286           "visibility" => "direct"
 287         })
 288
 289       {:ok, private_activity} =
 290         CommonAPI.post(user_one, %{"status" => "private", "visibility" => "private"})
 291
 292       resp = get(conn, "/api/v1/accounts/#{user_one.id}/statuses") |> json_response(200)
 293       assert [%{"id" => id}] = resp
 294       assert id == to_string(activity.id)
 295       assert_schema(resp, "StatusesResponse", ApiSpec.spec())
 296
 297       resp =
 298         conn
 299         |> assign(:user, user_two)
 300         |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
 301         |> get("/api/v1/accounts/#{user_one.id}/statuses")
 302         |> json_response(200)
 303
 304       assert [%{"id" => id_one}, %{"id" => id_two}] = resp
 305       assert id_one == to_string(direct_activity.id)
 306       assert id_two == to_string(activity.id)
 307       assert_schema(resp, "StatusesResponse", ApiSpec.spec())
 308
 309       resp =
 310         conn
 311         |> assign(:user, user_three)
 312         |> assign(:token, insert(:oauth_token, user: user_three, scopes: ["read:statuses"]))
 313         |> get("/api/v1/accounts/#{user_one.id}/statuses")
 314         |> json_response(200)
 315
 316       assert [%{"id" => id_one}, %{"id" => id_two}] = resp
 317       assert id_one == to_string(private_activity.id)
 318       assert id_two == to_string(activity.id)
 319       assert_schema(resp, "StatusesResponse", ApiSpec.spec())
 320     end
 321
 322     test "unimplemented pinned statuses feature", %{conn: conn} do
 323       note = insert(:note_activity)
 324       user = User.get_cached_by_ap_id(note.data["actor"])
 325
 326       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?pinned=true")
 327
 328       assert json_response(conn, 200) == []
 329     end
 330
 331     test "gets an users media", %{conn: conn} do
 332       note = insert(:note_activity)
 333       user = User.get_cached_by_ap_id(note.data["actor"])
 334
 335       file = %Plug.Upload{
 336         content_type: "image/jpg",
 337         path: Path.absname("test/fixtures/image.jpg"),
 338         filename: "an_image.jpg"
 339       }
 340
 341       {:ok, %{id: media_id}} = ActivityPub.upload(file, actor: user.ap_id)
 342
 343       {:ok, image_post} = CommonAPI.post(user, %{"status" => "cofe", "media_ids" => [media_id]})
 344
 345       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?only_media=true")
 346
 347       assert [%{"id" => id}] = json_response(conn, 200)
 348       assert id == to_string(image_post.id)
 349       assert_schema(json_response(conn, 200), "StatusesResponse", ApiSpec.spec())
 350
 351       conn = get(build_conn(), "/api/v1/accounts/#{user.id}/statuses?only_media=1")
 352
 353       assert [%{"id" => id}] = json_response(conn, 200)
 354       assert id == to_string(image_post.id)
 355       assert_schema(json_response(conn, 200), "StatusesResponse", ApiSpec.spec())
 356     end
 357
 358     test "gets a user's statuses without reblogs", %{user: user, conn: conn} do
 359       {:ok, post} = CommonAPI.post(user, %{"status" => "HI!!!"})
 360       {:ok, _, _} = CommonAPI.repeat(post.id, user)
 361
 362       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_reblogs=true")
 363
 364       assert [%{"id" => id}] = json_response(conn, 200)
 365       assert id == to_string(post.id)
 366       assert_schema(json_response(conn, 200), "StatusesResponse", ApiSpec.spec())
 367
 368       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_reblogs=1")
 369
 370       assert [%{"id" => id}] = json_response(conn, 200)
 371       assert id == to_string(post.id)
 372       assert_schema(json_response(conn, 200), "StatusesResponse", ApiSpec.spec())
 373     end
 374
 375     test "filters user's statuses by a hashtag", %{user: user, conn: conn} do
 376       {:ok, post} = CommonAPI.post(user, %{"status" => "#hashtag"})
 377       {:ok, _post} = CommonAPI.post(user, %{"status" => "hashtag"})
 378
 379       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?tagged=hashtag")
 380
 381       assert [%{"id" => id}] = json_response(conn, 200)
 382       assert id == to_string(post.id)
 383       assert_schema(json_response(conn, 200), "StatusesResponse", ApiSpec.spec())
 384     end
 385
 386     test "the user views their own timelines and excludes direct messages", %{
 387       user: user,
 388       conn: conn
 389     } do
 390       {:ok, public_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "public"})
 391       {:ok, _direct_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "direct"})
 392
 393       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_visibilities[]=direct")
 394
 395       assert [%{"id" => id}] = json_response(conn, 200)
 396       assert id == to_string(public_activity.id)
 397       assert_schema(json_response(conn, 200), "StatusesResponse", ApiSpec.spec())
 398     end
 399   end
 400
 401   defp local_and_remote_activities(%{local: local, remote: remote}) do
 402     insert(:note_activity, user: local)
 403     insert(:note_activity, user: remote, local: false)
 404
 405     :ok
 406   end
 407
 408   describe "statuses with restrict unauthenticated profiles for local and remote" do
 409     setup do: local_and_remote_users()
 410     setup :local_and_remote_activities
 411
 412     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 413
 414     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 415
 416     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 417       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 418
 419       assert json_response(res_conn, :not_found) == %{
 420                "error" => "Can't find user"
 421              }
 422
 423       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 424
 425       assert json_response(res_conn, :not_found) == %{
 426                "error" => "Can't find user"
 427              }
 428     end
 429
 430     test "if user is authenticated", %{local: local, remote: remote} do
 431       %{conn: conn} = oauth_access(["read"])
 432
 433       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 434       assert length(json_response(res_conn, 200)) == 1
 435       assert_schema(json_response(res_conn, 200), "StatusesResponse", ApiSpec.spec())
 436
 437       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 438       assert length(json_response(res_conn, 200)) == 1
 439       assert_schema(json_response(res_conn, 200), "StatusesResponse", ApiSpec.spec())
 440     end
 441   end
 442
 443   describe "statuses with restrict unauthenticated profiles for local" do
 444     setup do: local_and_remote_users()
 445     setup :local_and_remote_activities
 446
 447     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 448
 449     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 450       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 451
 452       assert json_response(res_conn, :not_found) == %{
 453                "error" => "Can't find user"
 454              }
 455
 456       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 457       assert length(json_response(res_conn, 200)) == 1
 458       assert_schema(json_response(res_conn, 200), "StatusesResponse", ApiSpec.spec())
 459     end
 460
 461     test "if user is authenticated", %{local: local, remote: remote} do
 462       %{conn: conn} = oauth_access(["read"])
 463
 464       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 465       assert length(json_response(res_conn, 200)) == 1
 466       assert_schema(json_response(res_conn, 200), "StatusesResponse", ApiSpec.spec())
 467
 468       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 469       assert length(json_response(res_conn, 200)) == 1
 470       assert_schema(json_response(res_conn, 200), "StatusesResponse", ApiSpec.spec())
 471     end
 472   end
 473
 474   describe "statuses with restrict unauthenticated profiles for remote" do
 475     setup do: local_and_remote_users()
 476     setup :local_and_remote_activities
 477
 478     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 479
 480     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 481       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 482       assert length(json_response(res_conn, 200)) == 1
 483       assert_schema(json_response(res_conn, 200), "StatusesResponse", ApiSpec.spec())
 484
 485       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 486
 487       assert json_response(res_conn, :not_found) == %{
 488                "error" => "Can't find user"
 489              }
 490     end
 491
 492     test "if user is authenticated", %{local: local, remote: remote} do
 493       %{conn: conn} = oauth_access(["read"])
 494
 495       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 496       assert length(json_response(res_conn, 200)) == 1
 497       assert_schema(json_response(res_conn, 200), "StatusesResponse", ApiSpec.spec())
 498
 499       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 500       assert length(json_response(res_conn, 200)) == 1
 501       assert_schema(json_response(res_conn, 200), "StatusesResponse", ApiSpec.spec())
 502     end
 503   end
 504
 505   describe "followers" do
 506     setup do: oauth_access(["read:accounts"])
 507
 508     test "getting followers", %{user: user, conn: conn} do
 509       other_user = insert(:user)
 510       {:ok, user} = User.follow(user, other_user)
 511
 512       conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")
 513
 514       assert [%{"id" => id}] = json_response(conn, 200)
 515       assert id == to_string(user.id)
 516       assert_schema(json_response(conn, 200), "AccountsResponse", ApiSpec.spec())
 517     end
 518
 519     test "getting followers, hide_followers", %{user: user, conn: conn} do
 520       other_user = insert(:user, hide_followers: true)
 521       {:ok, _user} = User.follow(user, other_user)
 522
 523       conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")
 524
 525       assert [] == json_response(conn, 200)
 526     end
 527
 528     test "getting followers, hide_followers, same user requesting" do
 529       user = insert(:user)
 530       other_user = insert(:user, hide_followers: true)
 531       {:ok, _user} = User.follow(user, other_user)
 532
 533       conn =
 534         build_conn()
 535         |> assign(:user, other_user)
 536         |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
 537         |> get("/api/v1/accounts/#{other_user.id}/followers")
 538
 539       refute [] == json_response(conn, 200)
 540       assert_schema(json_response(conn, 200), "AccountsResponse", ApiSpec.spec())
 541     end
 542
 543     test "getting followers, pagination", %{user: user, conn: conn} do
 544       follower1 = insert(:user)
 545       follower2 = insert(:user)
 546       follower3 = insert(:user)
 547       {:ok, _} = User.follow(follower1, user)
 548       {:ok, _} = User.follow(follower2, user)
 549       {:ok, _} = User.follow(follower3, user)
 550
 551       res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?since_id=#{follower1.id}")
 552
 553       assert [%{"id" => id3}, %{"id" => id2}] = json_response(res_conn, 200)
 554       assert id3 == follower3.id
 555       assert id2 == follower2.id
 556       assert_schema(json_response(res_conn, 200), "AccountsResponse", ApiSpec.spec())
 557
 558       res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?max_id=#{follower3.id}")
 559
 560       assert [%{"id" => id2}, %{"id" => id1}] = json_response(res_conn, 200)
 561       assert id2 == follower2.id
 562       assert id1 == follower1.id
 563
 564       res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?limit=1&max_id=#{follower3.id}")
 565
 566       assert [%{"id" => id2}] = json_response(res_conn, 200)
 567       assert id2 == follower2.id
 568
 569       assert [link_header] = get_resp_header(res_conn, "link")
 570       assert link_header =~ ~r/min_id=#{follower2.id}/
 571       assert link_header =~ ~r/max_id=#{follower2.id}/
 572       assert_schema(json_response(res_conn, 200), "AccountsResponse", ApiSpec.spec())
 573     end
 574   end
 575
 576   describe "following" do
 577     setup do: oauth_access(["read:accounts"])
 578
 579     test "getting following", %{user: user, conn: conn} do
 580       other_user = insert(:user)
 581       {:ok, user} = User.follow(user, other_user)
 582
 583       conn = get(conn, "/api/v1/accounts/#{user.id}/following")
 584
 585       assert [%{"id" => id}] = json_response(conn, 200)
 586       assert id == to_string(other_user.id)
 587       assert_schema(json_response(conn, 200), "AccountsResponse", ApiSpec.spec())
 588     end
 589
 590     test "getting following, hide_follows, other user requesting" do
 591       user = insert(:user, hide_follows: true)
 592       other_user = insert(:user)
 593       {:ok, user} = User.follow(user, other_user)
 594
 595       conn =
 596         build_conn()
 597         |> assign(:user, other_user)
 598         |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
 599         |> get("/api/v1/accounts/#{user.id}/following")
 600
 601       assert [] == json_response(conn, 200)
 602       assert_schema(json_response(conn, 200), "AccountsResponse", ApiSpec.spec())
 603     end
 604
 605     test "getting following, hide_follows, same user requesting" do
 606       user = insert(:user, hide_follows: true)
 607       other_user = insert(:user)
 608       {:ok, user} = User.follow(user, other_user)
 609
 610       conn =
 611         build_conn()
 612         |> assign(:user, user)
 613         |> assign(:token, insert(:oauth_token, user: user, scopes: ["read:accounts"]))
 614         |> get("/api/v1/accounts/#{user.id}/following")
 615
 616       refute [] == json_response(conn, 200)
 617     end
 618
 619     test "getting following, pagination", %{user: user, conn: conn} do
 620       following1 = insert(:user)
 621       following2 = insert(:user)
 622       following3 = insert(:user)
 623       {:ok, _} = User.follow(user, following1)
 624       {:ok, _} = User.follow(user, following2)
 625       {:ok, _} = User.follow(user, following3)
 626
 627       res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?since_id=#{following1.id}")
 628
 629       assert [%{"id" => id3}, %{"id" => id2}] = json_response(res_conn, 200)
 630       assert id3 == following3.id
 631       assert id2 == following2.id
 632       assert_schema(json_response(res_conn, 200), "AccountsResponse", ApiSpec.spec())
 633
 634       res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?max_id=#{following3.id}")
 635
 636       assert [%{"id" => id2}, %{"id" => id1}] = json_response(res_conn, 200)
 637       assert id2 == following2.id
 638       assert id1 == following1.id
 639       assert_schema(json_response(res_conn, 200), "AccountsResponse", ApiSpec.spec())
 640
 641       res_conn =
 642         get(conn, "/api/v1/accounts/#{user.id}/following?limit=1&max_id=#{following3.id}")
 643
 644       assert [%{"id" => id2}] = json_response(res_conn, 200)
 645       assert id2 == following2.id
 646
 647       assert [link_header] = get_resp_header(res_conn, "link")
 648       assert link_header =~ ~r/min_id=#{following2.id}/
 649       assert link_header =~ ~r/max_id=#{following2.id}/
 650       assert_schema(json_response(res_conn, 200), "AccountsResponse", ApiSpec.spec())
 651     end
 652   end
 653
 654   describe "follow/unfollow" do
 655     setup do: oauth_access(["follow"])
 656
 657     test "following / unfollowing a user", %{conn: conn} do
 658       other_user = insert(:user)
 659
 660       ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/follow")
 661
 662       assert %{"id" => _id, "following" => true} = json_response(ret_conn, 200)
 663       assert_schema(json_response(ret_conn, 200), "AccountRelationship", ApiSpec.spec())
 664
 665       ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/unfollow")
 666
 667       assert %{"id" => _id, "following" => false} = json_response(ret_conn, 200)
 668       assert_schema(json_response(ret_conn, 200), "AccountRelationship", ApiSpec.spec())
 669
 670       conn = post(conn, "/api/v1/follows", %{"uri" => other_user.nickname})
 671
 672       assert %{"id" => id} = json_response(conn, 200)
 673       assert id == to_string(other_user.id)
 674       assert_schema(json_response(conn, 200), "AccountRelationship", ApiSpec.spec())
 675     end
 676
 677     test "cancelling follow request", %{conn: conn} do
 678       %{id: other_user_id} = insert(:user, %{locked: true})
 679
 680       resp = conn |> post("/api/v1/accounts/#{other_user_id}/follow") |> json_response(:ok)
 681
 682       assert %{"id" => ^other_user_id, "following" => false, "requested" => true} = resp
 683       assert_schema(resp, "AccountRelationship", ApiSpec.spec())
 684
 685       resp = conn |> post("/api/v1/accounts/#{other_user_id}/unfollow") |> json_response(:ok)
 686
 687       assert %{"id" => ^other_user_id, "following" => false, "requested" => false} = resp
 688       assert_schema(resp, "AccountRelationship", ApiSpec.spec())
 689     end
 690
 691     test "following without reblogs" do
 692       %{conn: conn} = oauth_access(["follow", "read:statuses"])
 693       followed = insert(:user)
 694       other_user = insert(:user)
 695
 696       ret_conn = post(conn, "/api/v1/accounts/#{followed.id}/follow?reblogs=false")
 697
 698       assert %{"showing_reblogs" => false} = json_response(ret_conn, 200)
 699       assert_schema(json_response(ret_conn, 200), "AccountRelationship", ApiSpec.spec())
 700
 701       {:ok, activity} = CommonAPI.post(other_user, %{"status" => "hey"})
 702       {:ok, reblog, _} = CommonAPI.repeat(activity.id, followed)
 703
 704       ret_conn = get(conn, "/api/v1/timelines/home")
 705
 706       assert [] == json_response(ret_conn, 200)
 707
 708       ret_conn = post(conn, "/api/v1/accounts/#{followed.id}/follow?reblogs=true")
 709
 710       assert %{"showing_reblogs" => true} = json_response(ret_conn, 200)
 711       assert_schema(json_response(ret_conn, 200), "AccountRelationship", ApiSpec.spec())
 712
 713       conn = get(conn, "/api/v1/timelines/home")
 714
 715       expected_activity_id = reblog.id
 716       assert [%{"id" => ^expected_activity_id}] = json_response(conn, 200)
 717     end
 718
 719     test "following / unfollowing errors", %{user: user, conn: conn} do
 720       # self follow
 721       conn_res = post(conn, "/api/v1/accounts/#{user.id}/follow")
 722       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 723
 724       # self unfollow
 725       user = User.get_cached_by_id(user.id)
 726       conn_res = post(conn, "/api/v1/accounts/#{user.id}/unfollow")
 727       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 728
 729       # self follow via uri
 730       user = User.get_cached_by_id(user.id)
 731       conn_res = post(conn, "/api/v1/follows", %{"uri" => user.nickname})
 732       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 733
 734       # follow non existing user
 735       conn_res = post(conn, "/api/v1/accounts/doesntexist/follow")
 736       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 737
 738       # follow non existing user via uri
 739       conn_res = post(conn, "/api/v1/follows", %{"uri" => "doesntexist"})
 740       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 741
 742       # unfollow non existing user
 743       conn_res = post(conn, "/api/v1/accounts/doesntexist/unfollow")
 744       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 745     end
 746   end
 747
 748   describe "mute/unmute" do
 749     setup do: oauth_access(["write:mutes"])
 750
 751     test "with notifications", %{conn: conn} do
 752       other_user = insert(:user)
 753
 754       ret_conn =
 755         conn
 756         |> put_req_header("content-type", "application/json")
 757         |> post("/api/v1/accounts/#{other_user.id}/mute")
 758
 759       response = json_response(ret_conn, 200)
 760
 761       assert %{"id" => _id, "muting" => true, "muting_notifications" => true} = response
 762       assert_schema(response, "AccountRelationship", ApiSpec.spec())
 763
 764       conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")
 765
 766       response = json_response(conn, 200)
 767       assert %{"id" => _id, "muting" => false, "muting_notifications" => false} = response
 768       assert_schema(response, "AccountRelationship", ApiSpec.spec())
 769     end
 770
 771     test "without notifications", %{conn: conn} do
 772       other_user = insert(:user)
 773
 774       ret_conn =
 775         conn
 776         |> put_req_header("content-type", "multipart/form-data")
 777         |> post("/api/v1/accounts/#{other_user.id}/mute", %{"notifications" => "false"})
 778
 779       response = json_response(ret_conn, 200)
 780
 781       assert %{"id" => _id, "muting" => true, "muting_notifications" => false} = response
 782       assert_schema(response, "AccountRelationship", ApiSpec.spec())
 783
 784       conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")
 785
 786       response = json_response(conn, 200)
 787       assert %{"id" => _id, "muting" => false, "muting_notifications" => false} = response
 788       assert_schema(response, "AccountRelationship", ApiSpec.spec())
 789     end
 790   end
 791
 792   describe "pinned statuses" do
 793     setup do
 794       user = insert(:user)
 795       {:ok, activity} = CommonAPI.post(user, %{"status" => "HI!!!"})
 796       %{conn: conn} = oauth_access(["read:statuses"], user: user)
 797
 798       [conn: conn, user: user, activity: activity]
 799     end
 800
 801     test "returns pinned statuses", %{conn: conn, user: user, activity: activity} do
 802       {:ok, _} = CommonAPI.pin(activity.id, user)
 803
 804       result =
 805         conn
 806         |> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
 807         |> json_response(200)
 808
 809       id_str = to_string(activity.id)
 810
 811       assert [%{"id" => ^id_str, "pinned" => true}] = result
 812     end
 813   end
 814
 815   test "blocking / unblocking a user" do
 816     %{conn: conn} = oauth_access(["follow"])
 817     other_user = insert(:user)
 818
 819     ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/block")
 820
 821     assert %{"id" => _id, "blocking" => true} = json_response(ret_conn, 200)
 822
 823     conn = post(conn, "/api/v1/accounts/#{other_user.id}/unblock")
 824
 825     assert %{"id" => _id, "blocking" => false} = json_response(conn, 200)
 826   end
 827
 828   describe "create account by app" do
 829     setup do
 830       valid_params = %{
 831         username: "lain",
 832         email: "lain@example.org",
 833         password: "PlzDontHackLain",
 834         agreement: true
 835       }
 836
 837       [valid_params: valid_params]
 838     end
 839
 840     setup do: clear_config([:instance, :account_activation_required])
 841
 842     test "Account registration via Application", %{conn: conn} do
 843       conn =
 844         conn
 845         |> put_req_header("content-type", "application/json")
 846         |> post("/api/v1/apps", %{
 847           client_name: "client_name",
 848           redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
 849           scopes: "read, write, follow"
 850         })
 851
 852       %{
 853         "client_id" => client_id,
 854         "client_secret" => client_secret,
 855         "id" => _,
 856         "name" => "client_name",
 857         "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
 858         "vapid_key" => _,
 859         "website" => nil
 860       } = json_response(conn, 200)
 861
 862       conn =
 863         post(conn, "/oauth/token", %{
 864           grant_type: "client_credentials",
 865           client_id: client_id,
 866           client_secret: client_secret
 867         })
 868
 869       assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
 870                json_response(conn, 200)
 871
 872       assert token
 873       token_from_db = Repo.get_by(Token, token: token)
 874       assert token_from_db
 875       assert refresh
 876       assert scope == "read write follow"
 877
 878       conn =
 879         build_conn()
 880         |> put_req_header("content-type", "multipart/form-data")
 881         |> put_req_header("authorization", "Bearer " <> token)
 882         |> post("/api/v1/accounts", %{
 883           username: "lain",
 884           email: "lain@example.org",
 885           password: "PlzDontHackLain",
 886           bio: "Test Bio",
 887           agreement: true
 888         })
 889
 890       %{
 891         "access_token" => token,
 892         "created_at" => _created_at,
 893         "scope" => _scope,
 894         "token_type" => "Bearer"
 895       } = json_response(conn, 200)
 896
 897       token_from_db = Repo.get_by(Token, token: token)
 898       assert token_from_db
 899       token_from_db = Repo.preload(token_from_db, :user)
 900       assert token_from_db.user
 901
 902       assert token_from_db.user.confirmation_pending
 903     end
 904
 905     test "returns error when user already registred", %{conn: conn, valid_params: valid_params} do
 906       _user = insert(:user, email: "lain@example.org")
 907       app_token = insert(:oauth_token, user: nil)
 908
 909       res =
 910         conn
 911         |> put_req_header("authorization", "Bearer " <> app_token.token)
 912         |> put_req_header("content-type", "application/json")
 913         |> post("/api/v1/accounts", valid_params)
 914
 915       assert json_response(res, 400) == %{"error" => "{\"email\":[\"has already been taken\"]}"}
 916     end
 917
 918     test "returns bad_request if missing required params", %{
 919       conn: conn,
 920       valid_params: valid_params
 921     } do
 922       app_token = insert(:oauth_token, user: nil)
 923
 924       conn =
 925         conn
 926         |> put_req_header("authorization", "Bearer " <> app_token.token)
 927         |> put_req_header("content-type", "application/json")
 928
 929       res = post(conn, "/api/v1/accounts", valid_params)
 930       assert json_response(res, 200)
 931
 932       [{127, 0, 0, 1}, {127, 0, 0, 2}, {127, 0, 0, 3}, {127, 0, 0, 4}]
 933       |> Stream.zip(Map.delete(valid_params, :email))
 934       |> Enum.each(fn {ip, {attr, _}} ->
 935         res =
 936           conn
 937           |> Map.put(:remote_ip, ip)
 938           |> post("/api/v1/accounts", Map.delete(valid_params, attr))
 939           |> json_response(400)
 940
 941         assert res == %{"error" => "Missing parameters"}
 942       end)
 943     end
 944
 945     setup do: clear_config([:instance, :account_activation_required])
 946
 947     test "returns bad_request if missing email params when :account_activation_required is enabled",
 948          %{conn: conn, valid_params: valid_params} do
 949       Pleroma.Config.put([:instance, :account_activation_required], true)
 950
 951       app_token = insert(:oauth_token, user: nil)
 952
 953       conn =
 954         conn
 955         |> put_req_header("authorization", "Bearer " <> app_token.token)
 956         |> put_req_header("content-type", "application/json")
 957
 958       res =
 959         conn
 960         |> Map.put(:remote_ip, {127, 0, 0, 5})
 961         |> post("/api/v1/accounts", Map.delete(valid_params, :email))
 962
 963       assert json_response(res, 400) == %{"error" => "Missing parameters"}
 964
 965       res =
 966         conn
 967         |> Map.put(:remote_ip, {127, 0, 0, 6})
 968         |> post("/api/v1/accounts", Map.put(valid_params, :email, ""))
 969
 970       assert json_response(res, 400) == %{"error" => "{\"email\":[\"can't be blank\"]}"}
 971     end
 972
 973     test "allow registration without an email", %{conn: conn, valid_params: valid_params} do
 974       app_token = insert(:oauth_token, user: nil)
 975       conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
 976
 977       res =
 978         conn
 979         |> put_req_header("content-type", "application/json")
 980         |> Map.put(:remote_ip, {127, 0, 0, 7})
 981         |> post("/api/v1/accounts", Map.delete(valid_params, :email))
 982
 983       assert json_response(res, 200)
 984     end
 985
 986     test "allow registration with an empty email", %{conn: conn, valid_params: valid_params} do
 987       app_token = insert(:oauth_token, user: nil)
 988       conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
 989
 990       res =
 991         conn
 992         |> put_req_header("content-type", "application/json")
 993         |> Map.put(:remote_ip, {127, 0, 0, 8})
 994         |> post("/api/v1/accounts", Map.put(valid_params, :email, ""))
 995
 996       assert json_response(res, 200)
 997     end
 998
 999     test "returns forbidden if token is invalid", %{conn: conn, valid_params: valid_params} do
1000       res =
1001         conn
1002         |> put_req_header("authorization", "Bearer " <> "invalid-token")
1003         |> put_req_header("content-type", "multipart/form-data")
1004         |> post("/api/v1/accounts", valid_params)
1005
1006       assert json_response(res, 403) == %{"error" => "Invalid credentials"}
1007     end
1008   end
1009
1010   describe "create account by app / rate limit" do
1011     setup do: clear_config([:rate_limit, :app_account_creation], {10_000, 2})
1012
1013     test "respects rate limit setting", %{conn: conn} do
1014       app_token = insert(:oauth_token, user: nil)
1015
1016       conn =
1017         conn
1018         |> put_req_header("authorization", "Bearer " <> app_token.token)
1019         |> Map.put(:remote_ip, {15, 15, 15, 15})
1020         |> put_req_header("content-type", "multipart/form-data")
1021
1022       for i <- 1..2 do
1023         conn =
1024           conn
1025           |> post("/api/v1/accounts", %{
1026             username: "#{i}lain",
1027             email: "#{i}lain@example.org",
1028             password: "PlzDontHackLain",
1029             agreement: true
1030           })
1031
1032         %{
1033           "access_token" => token,
1034           "created_at" => _created_at,
1035           "scope" => _scope,
1036           "token_type" => "Bearer"
1037         } = json_response(conn, 200)
1038
1039         token_from_db = Repo.get_by(Token, token: token)
1040         assert token_from_db
1041         token_from_db = Repo.preload(token_from_db, :user)
1042         assert token_from_db.user
1043
1044         assert token_from_db.user.confirmation_pending
1045       end
1046
1047       conn =
1048         post(conn, "/api/v1/accounts", %{
1049           username: "6lain",
1050           email: "6lain@example.org",
1051           password: "PlzDontHackLain",
1052           agreement: true
1053         })
1054
1055       assert json_response(conn, :too_many_requests) == %{"error" => "Throttled"}
1056     end
1057   end
1058
1059   describe "GET /api/v1/accounts/:id/lists - account_lists" do
1060     test "returns lists to which the account belongs" do
1061       %{user: user, conn: conn} = oauth_access(["read:lists"])
1062       other_user = insert(:user)
1063       assert {:ok, %Pleroma.List{} = list} = Pleroma.List.create("Test List", user)
1064       {:ok, %{following: _following}} = Pleroma.List.follow(list, other_user)
1065
1066       res =
1067         conn
1068         |> get("/api/v1/accounts/#{other_user.id}/lists")
1069         |> json_response(200)
1070
1071       assert res == [%{"id" => to_string(list.id), "title" => "Test List"}]
1072       assert_schema(res, "ListsResponse", ApiSpec.spec())
1073     end
1074   end
1075
1076   describe "verify_credentials" do
1077     test "verify_credentials" do
1078       %{user: user, conn: conn} = oauth_access(["read:accounts"])
1079       conn = get(conn, "/api/v1/accounts/verify_credentials")
1080
1081       response = json_response(conn, 200)
1082
1083       assert %{"id" => id, "source" => %{"privacy" => "public"}} = response
1084       assert response["pleroma"]["chat_token"]
1085       assert id == to_string(user.id)
1086     end
1087
1088     test "verify_credentials default scope unlisted" do
1089       user = insert(:user, default_scope: "unlisted")
1090       %{conn: conn} = oauth_access(["read:accounts"], user: user)
1091
1092       conn = get(conn, "/api/v1/accounts/verify_credentials")
1093
1094       assert %{"id" => id, "source" => %{"privacy" => "unlisted"}} = json_response(conn, 200)
1095       assert id == to_string(user.id)
1096     end
1097
1098     test "locked accounts" do
1099       user = insert(:user, default_scope: "private")
1100       %{conn: conn} = oauth_access(["read:accounts"], user: user)
1101
1102       conn = get(conn, "/api/v1/accounts/verify_credentials")
1103
1104       assert %{"id" => id, "source" => %{"privacy" => "private"}} = json_response(conn, 200)
1105       assert id == to_string(user.id)
1106     end
1107   end
1108
1109   describe "user relationships" do
1110     setup do: oauth_access(["read:follows"])
1111
1112     test "returns the relationships for the current user", %{user: user, conn: conn} do
1113       %{id: other_user_id} = other_user = insert(:user)
1114       {:ok, _user} = User.follow(user, other_user)
1115
1116       assert [%{"id" => ^other_user_id}] =
1117                conn
1118                |> get("/api/v1/accounts/relationships?id=#{other_user.id}")
1119                |> json_response(200)
1120
1121       assert [%{"id" => ^other_user_id}] =
1122                conn
1123                |> get("/api/v1/accounts/relationships?id[]=#{other_user.id}")
1124                |> json_response(200)
1125     end
1126
1127     test "returns an empty list on a bad request", %{conn: conn} do
1128       conn = get(conn, "/api/v1/accounts/relationships", %{})
1129
1130       assert [] = json_response(conn, 200)
1131     end
1132   end
1133
1134   test "getting a list of mutes" do
1135     %{user: user, conn: conn} = oauth_access(["read:mutes"])
1136     other_user = insert(:user)
1137
1138     {:ok, _user_relationships} = User.mute(user, other_user)
1139
1140     conn = get(conn, "/api/v1/mutes")
1141
1142     other_user_id = to_string(other_user.id)
1143     assert [%{"id" => ^other_user_id}] = json_response(conn, 200)
1144   end
1145
1146   test "getting a list of blocks" do
1147     %{user: user, conn: conn} = oauth_access(["read:blocks"])
1148     other_user = insert(:user)
1149
1150     {:ok, _user_relationship} = User.block(user, other_user)
1151
1152     conn =
1153       conn
1154       |> assign(:user, user)
1155       |> get("/api/v1/blocks")
1156
1157     other_user_id = to_string(other_user.id)
1158     assert [%{"id" => ^other_user_id}] = json_response(conn, 200)
1159   end
1160 end