git.squeep.com Git - akkoma/blob - test/web/mastodon_api/controllers/account_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.AccountControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   alias Pleroma.Config
   9   alias Pleroma.Repo
  10   alias Pleroma.User
  11   alias Pleroma.Web.ActivityPub.ActivityPub
  12   alias Pleroma.Web.ActivityPub.InternalFetchActor
  13   alias Pleroma.Web.CommonAPI
  14   alias Pleroma.Web.OAuth.Token
  15
  16   import Pleroma.Factory
  17
  18   describe "account fetching" do
  19     setup do: clear_config([:instance, :limit_to_local_content])
  20
  21     test "works by id" do
  22       user = insert(:user)
  23
  24       conn =
  25         build_conn()
  26         |> get("/api/v1/accounts/#{user.id}")
  27
  28       assert %{"id" => id} = json_response(conn, 200)
  29       assert id == to_string(user.id)
  30
  31       conn =
  32         build_conn()
  33         |> get("/api/v1/accounts/-1")
  34
  35       assert %{"error" => "Can't find user"} = json_response(conn, 404)
  36     end
  37
  38     test "works by nickname" do
  39       user = insert(:user)
  40
  41       conn =
  42         build_conn()
  43         |> get("/api/v1/accounts/#{user.nickname}")
  44
  45       assert %{"id" => id} = json_response(conn, 200)
  46       assert id == user.id
  47     end
  48
  49     test "works by nickname for remote users" do
  50       Config.put([:instance, :limit_to_local_content], false)
  51       user = insert(:user, nickname: "user@example.com", local: false)
  52
  53       conn =
  54         build_conn()
  55         |> get("/api/v1/accounts/#{user.nickname}")
  56
  57       assert %{"id" => id} = json_response(conn, 200)
  58       assert id == user.id
  59     end
  60
  61     test "respects limit_to_local_content == :all for remote user nicknames" do
  62       Config.put([:instance, :limit_to_local_content], :all)
  63
  64       user = insert(:user, nickname: "user@example.com", local: false)
  65
  66       conn =
  67         build_conn()
  68         |> get("/api/v1/accounts/#{user.nickname}")
  69
  70       assert json_response(conn, 404)
  71     end
  72
  73     test "respects limit_to_local_content == :unauthenticated for remote user nicknames" do
  74       Config.put([:instance, :limit_to_local_content], :unauthenticated)
  75
  76       user = insert(:user, nickname: "user@example.com", local: false)
  77       reading_user = insert(:user)
  78
  79       conn =
  80         build_conn()
  81         |> get("/api/v1/accounts/#{user.nickname}")
  82
  83       assert json_response(conn, 404)
  84
  85       conn =
  86         build_conn()
  87         |> assign(:user, reading_user)
  88         |> assign(:token, insert(:oauth_token, user: reading_user, scopes: ["read:accounts"]))
  89         |> get("/api/v1/accounts/#{user.nickname}")
  90
  91       assert %{"id" => id} = json_response(conn, 200)
  92       assert id == user.id
  93     end
  94
  95     test "accounts fetches correct account for nicknames beginning with numbers", %{conn: conn} do
  96       # Need to set an old-style integer ID to reproduce the problem
  97       # (these are no longer assigned to new accounts but were preserved
  98       # for existing accounts during the migration to flakeIDs)
  99       user_one = insert(:user, %{id: 1212})
 100       user_two = insert(:user, %{nickname: "#{user_one.id}garbage"})
 101
 102       resp_one =
 103         conn
 104         |> get("/api/v1/accounts/#{user_one.id}")
 105
 106       resp_two =
 107         conn
 108         |> get("/api/v1/accounts/#{user_two.nickname}")
 109
 110       resp_three =
 111         conn
 112         |> get("/api/v1/accounts/#{user_two.id}")
 113
 114       acc_one = json_response(resp_one, 200)
 115       acc_two = json_response(resp_two, 200)
 116       acc_three = json_response(resp_three, 200)
 117       refute acc_one == acc_two
 118       assert acc_two == acc_three
 119     end
 120
 121     test "returns 404 when user is invisible", %{conn: conn} do
 122       user = insert(:user, %{invisible: true})
 123
 124       resp =
 125         conn
 126         |> get("/api/v1/accounts/#{user.nickname}")
 127         |> json_response(404)
 128
 129       assert %{"error" => "Can't find user"} = resp
 130     end
 131
 132     test "returns 404 for internal.fetch actor", %{conn: conn} do
 133       %User{nickname: "internal.fetch"} = InternalFetchActor.get_actor()
 134
 135       resp =
 136         conn
 137         |> get("/api/v1/accounts/internal.fetch")
 138         |> json_response(404)
 139
 140       assert %{"error" => "Can't find user"} = resp
 141     end
 142   end
 143
 144   defp local_and_remote_users do
 145     local = insert(:user)
 146     remote = insert(:user, local: false)
 147     {:ok, local: local, remote: remote}
 148   end
 149
 150   describe "user fetching with restrict unauthenticated profiles for local and remote" do
 151     setup do: local_and_remote_users()
 152
 153     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 154
 155     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 156
 157     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 158       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 159
 160       assert json_response(res_conn, :not_found) == %{
 161                "error" => "Can't find user"
 162              }
 163
 164       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 165
 166       assert json_response(res_conn, :not_found) == %{
 167                "error" => "Can't find user"
 168              }
 169     end
 170
 171     test "if user is authenticated", %{local: local, remote: remote} do
 172       %{conn: conn} = oauth_access(["read"])
 173
 174       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 175       assert %{"id" => _} = json_response(res_conn, 200)
 176
 177       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 178       assert %{"id" => _} = json_response(res_conn, 200)
 179     end
 180   end
 181
 182   describe "user fetching with restrict unauthenticated profiles for local" do
 183     setup do: local_and_remote_users()
 184
 185     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 186
 187     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 188       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 189
 190       assert json_response(res_conn, :not_found) == %{
 191                "error" => "Can't find user"
 192              }
 193
 194       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 195       assert %{"id" => _} = json_response(res_conn, 200)
 196     end
 197
 198     test "if user is authenticated", %{local: local, remote: remote} do
 199       %{conn: conn} = oauth_access(["read"])
 200
 201       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 202       assert %{"id" => _} = json_response(res_conn, 200)
 203
 204       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 205       assert %{"id" => _} = json_response(res_conn, 200)
 206     end
 207   end
 208
 209   describe "user fetching with restrict unauthenticated profiles for remote" do
 210     setup do: local_and_remote_users()
 211
 212     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 213
 214     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 215       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 216       assert %{"id" => _} = json_response(res_conn, 200)
 217
 218       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 219
 220       assert json_response(res_conn, :not_found) == %{
 221                "error" => "Can't find user"
 222              }
 223     end
 224
 225     test "if user is authenticated", %{local: local, remote: remote} do
 226       %{conn: conn} = oauth_access(["read"])
 227
 228       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 229       assert %{"id" => _} = json_response(res_conn, 200)
 230
 231       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 232       assert %{"id" => _} = json_response(res_conn, 200)
 233     end
 234   end
 235
 236   describe "user timelines" do
 237     setup do: oauth_access(["read:statuses"])
 238
 239     test "respects blocks", %{user: user_one, conn: conn} do
 240       user_two = insert(:user)
 241       user_three = insert(:user)
 242
 243       User.block(user_one, user_two)
 244
 245       {:ok, activity} = CommonAPI.post(user_two, %{"status" => "User one sux0rz"})
 246       {:ok, repeat, _} = CommonAPI.repeat(activity.id, user_three)
 247
 248       resp = get(conn, "/api/v1/accounts/#{user_two.id}/statuses")
 249
 250       assert [%{"id" => id}] = json_response(resp, 200)
 251       assert id == activity.id
 252
 253       # Even a blocked user will deliver the full user timeline, there would be
 254       #   no point in looking at a blocked users timeline otherwise
 255       resp = get(conn, "/api/v1/accounts/#{user_two.id}/statuses")
 256
 257       assert [%{"id" => id}] = json_response(resp, 200)
 258       assert id == activity.id
 259
 260       # Third user's timeline includes the repeat when viewed by unauthenticated user
 261       resp = get(build_conn(), "/api/v1/accounts/#{user_three.id}/statuses")
 262       assert [%{"id" => id}] = json_response(resp, 200)
 263       assert id == repeat.id
 264
 265       # When viewing a third user's timeline, the blocked users' statuses will NOT be shown
 266       resp = get(conn, "/api/v1/accounts/#{user_three.id}/statuses")
 267
 268       assert [] = json_response(resp, 200)
 269     end
 270
 271     test "gets users statuses", %{conn: conn} do
 272       user_one = insert(:user)
 273       user_two = insert(:user)
 274       user_three = insert(:user)
 275
 276       {:ok, _user_three} = User.follow(user_three, user_one)
 277
 278       {:ok, activity} = CommonAPI.post(user_one, %{"status" => "HI!!!"})
 279
 280       {:ok, direct_activity} =
 281         CommonAPI.post(user_one, %{
 282           "status" => "Hi, @#{user_two.nickname}.",
 283           "visibility" => "direct"
 284         })
 285
 286       {:ok, private_activity} =
 287         CommonAPI.post(user_one, %{"status" => "private", "visibility" => "private"})
 288
 289       resp = get(conn, "/api/v1/accounts/#{user_one.id}/statuses")
 290
 291       assert [%{"id" => id}] = json_response(resp, 200)
 292       assert id == to_string(activity.id)
 293
 294       resp =
 295         conn
 296         |> assign(:user, user_two)
 297         |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
 298         |> get("/api/v1/accounts/#{user_one.id}/statuses")
 299
 300       assert [%{"id" => id_one}, %{"id" => id_two}] = json_response(resp, 200)
 301       assert id_one == to_string(direct_activity.id)
 302       assert id_two == to_string(activity.id)
 303
 304       resp =
 305         conn
 306         |> assign(:user, user_three)
 307         |> assign(:token, insert(:oauth_token, user: user_three, scopes: ["read:statuses"]))
 308         |> get("/api/v1/accounts/#{user_one.id}/statuses")
 309
 310       assert [%{"id" => id_one}, %{"id" => id_two}] = json_response(resp, 200)
 311       assert id_one == to_string(private_activity.id)
 312       assert id_two == to_string(activity.id)
 313     end
 314
 315     test "unimplemented pinned statuses feature", %{conn: conn} do
 316       note = insert(:note_activity)
 317       user = User.get_cached_by_ap_id(note.data["actor"])
 318
 319       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?pinned=true")
 320
 321       assert json_response(conn, 200) == []
 322     end
 323
 324     test "gets an users media", %{conn: conn} do
 325       note = insert(:note_activity)
 326       user = User.get_cached_by_ap_id(note.data["actor"])
 327
 328       file = %Plug.Upload{
 329         content_type: "image/jpg",
 330         path: Path.absname("test/fixtures/image.jpg"),
 331         filename: "an_image.jpg"
 332       }
 333
 334       {:ok, %{id: media_id}} = ActivityPub.upload(file, actor: user.ap_id)
 335
 336       {:ok, image_post} = CommonAPI.post(user, %{"status" => "cofe", "media_ids" => [media_id]})
 337
 338       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses", %{"only_media" => "true"})
 339
 340       assert [%{"id" => id}] = json_response(conn, 200)
 341       assert id == to_string(image_post.id)
 342
 343       conn = get(build_conn(), "/api/v1/accounts/#{user.id}/statuses", %{"only_media" => "1"})
 344
 345       assert [%{"id" => id}] = json_response(conn, 200)
 346       assert id == to_string(image_post.id)
 347     end
 348
 349     test "gets a user's statuses without reblogs", %{user: user, conn: conn} do
 350       {:ok, post} = CommonAPI.post(user, %{"status" => "HI!!!"})
 351       {:ok, _, _} = CommonAPI.repeat(post.id, user)
 352
 353       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses", %{"exclude_reblogs" => "true"})
 354
 355       assert [%{"id" => id}] = json_response(conn, 200)
 356       assert id == to_string(post.id)
 357
 358       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses", %{"exclude_reblogs" => "1"})
 359
 360       assert [%{"id" => id}] = json_response(conn, 200)
 361       assert id == to_string(post.id)
 362     end
 363
 364     test "filters user's statuses by a hashtag", %{user: user, conn: conn} do
 365       {:ok, post} = CommonAPI.post(user, %{"status" => "#hashtag"})
 366       {:ok, _post} = CommonAPI.post(user, %{"status" => "hashtag"})
 367
 368       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses", %{"tagged" => "hashtag"})
 369
 370       assert [%{"id" => id}] = json_response(conn, 200)
 371       assert id == to_string(post.id)
 372     end
 373
 374     test "the user views their own timelines and excludes direct messages", %{
 375       user: user,
 376       conn: conn
 377     } do
 378       {:ok, public_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "public"})
 379       {:ok, _direct_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "direct"})
 380
 381       conn =
 382         get(conn, "/api/v1/accounts/#{user.id}/statuses", %{"exclude_visibilities" => ["direct"]})
 383
 384       assert [%{"id" => id}] = json_response(conn, 200)
 385       assert id == to_string(public_activity.id)
 386     end
 387   end
 388
 389   defp local_and_remote_activities(%{local: local, remote: remote}) do
 390     insert(:note_activity, user: local)
 391     insert(:note_activity, user: remote, local: false)
 392
 393     :ok
 394   end
 395
 396   describe "statuses with restrict unauthenticated profiles for local and remote" do
 397     setup do: local_and_remote_users()
 398     setup :local_and_remote_activities
 399
 400     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 401
 402     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 403
 404     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 405       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 406
 407       assert json_response(res_conn, :not_found) == %{
 408                "error" => "Can't find user"
 409              }
 410
 411       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 412
 413       assert json_response(res_conn, :not_found) == %{
 414                "error" => "Can't find user"
 415              }
 416     end
 417
 418     test "if user is authenticated", %{local: local, remote: remote} do
 419       %{conn: conn} = oauth_access(["read"])
 420
 421       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 422       assert length(json_response(res_conn, 200)) == 1
 423
 424       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 425       assert length(json_response(res_conn, 200)) == 1
 426     end
 427   end
 428
 429   describe "statuses with restrict unauthenticated profiles for local" do
 430     setup do: local_and_remote_users()
 431     setup :local_and_remote_activities
 432
 433     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 434
 435     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 436       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 437
 438       assert json_response(res_conn, :not_found) == %{
 439                "error" => "Can't find user"
 440              }
 441
 442       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 443       assert length(json_response(res_conn, 200)) == 1
 444     end
 445
 446     test "if user is authenticated", %{local: local, remote: remote} do
 447       %{conn: conn} = oauth_access(["read"])
 448
 449       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 450       assert length(json_response(res_conn, 200)) == 1
 451
 452       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 453       assert length(json_response(res_conn, 200)) == 1
 454     end
 455   end
 456
 457   describe "statuses with restrict unauthenticated profiles for remote" do
 458     setup do: local_and_remote_users()
 459     setup :local_and_remote_activities
 460
 461     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 462
 463     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 464       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 465       assert length(json_response(res_conn, 200)) == 1
 466
 467       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 468
 469       assert json_response(res_conn, :not_found) == %{
 470                "error" => "Can't find user"
 471              }
 472     end
 473
 474     test "if user is authenticated", %{local: local, remote: remote} do
 475       %{conn: conn} = oauth_access(["read"])
 476
 477       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 478       assert length(json_response(res_conn, 200)) == 1
 479
 480       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 481       assert length(json_response(res_conn, 200)) == 1
 482     end
 483   end
 484
 485   describe "followers" do
 486     setup do: oauth_access(["read:accounts"])
 487
 488     test "getting followers", %{user: user, conn: conn} do
 489       other_user = insert(:user)
 490       {:ok, user} = User.follow(user, other_user)
 491
 492       conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")
 493
 494       assert [%{"id" => id}] = json_response(conn, 200)
 495       assert id == to_string(user.id)
 496     end
 497
 498     test "getting followers, hide_followers", %{user: user, conn: conn} do
 499       other_user = insert(:user, hide_followers: true)
 500       {:ok, _user} = User.follow(user, other_user)
 501
 502       conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")
 503
 504       assert [] == json_response(conn, 200)
 505     end
 506
 507     test "getting followers, hide_followers, same user requesting" do
 508       user = insert(:user)
 509       other_user = insert(:user, hide_followers: true)
 510       {:ok, _user} = User.follow(user, other_user)
 511
 512       conn =
 513         build_conn()
 514         |> assign(:user, other_user)
 515         |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
 516         |> get("/api/v1/accounts/#{other_user.id}/followers")
 517
 518       refute [] == json_response(conn, 200)
 519     end
 520
 521     test "getting followers, pagination", %{user: user, conn: conn} do
 522       follower1 = insert(:user)
 523       follower2 = insert(:user)
 524       follower3 = insert(:user)
 525       {:ok, _} = User.follow(follower1, user)
 526       {:ok, _} = User.follow(follower2, user)
 527       {:ok, _} = User.follow(follower3, user)
 528
 529       res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?since_id=#{follower1.id}")
 530
 531       assert [%{"id" => id3}, %{"id" => id2}] = json_response(res_conn, 200)
 532       assert id3 == follower3.id
 533       assert id2 == follower2.id
 534
 535       res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?max_id=#{follower3.id}")
 536
 537       assert [%{"id" => id2}, %{"id" => id1}] = json_response(res_conn, 200)
 538       assert id2 == follower2.id
 539       assert id1 == follower1.id
 540
 541       res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?limit=1&max_id=#{follower3.id}")
 542
 543       assert [%{"id" => id2}] = json_response(res_conn, 200)
 544       assert id2 == follower2.id
 545
 546       assert [link_header] = get_resp_header(res_conn, "link")
 547       assert link_header =~ ~r/min_id=#{follower2.id}/
 548       assert link_header =~ ~r/max_id=#{follower2.id}/
 549     end
 550   end
 551
 552   describe "following" do
 553     setup do: oauth_access(["read:accounts"])
 554
 555     test "getting following", %{user: user, conn: conn} do
 556       other_user = insert(:user)
 557       {:ok, user} = User.follow(user, other_user)
 558
 559       conn = get(conn, "/api/v1/accounts/#{user.id}/following")
 560
 561       assert [%{"id" => id}] = json_response(conn, 200)
 562       assert id == to_string(other_user.id)
 563     end
 564
 565     test "getting following, hide_follows, other user requesting" do
 566       user = insert(:user, hide_follows: true)
 567       other_user = insert(:user)
 568       {:ok, user} = User.follow(user, other_user)
 569
 570       conn =
 571         build_conn()
 572         |> assign(:user, other_user)
 573         |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
 574         |> get("/api/v1/accounts/#{user.id}/following")
 575
 576       assert [] == json_response(conn, 200)
 577     end
 578
 579     test "getting following, hide_follows, same user requesting" do
 580       user = insert(:user, hide_follows: true)
 581       other_user = insert(:user)
 582       {:ok, user} = User.follow(user, other_user)
 583
 584       conn =
 585         build_conn()
 586         |> assign(:user, user)
 587         |> assign(:token, insert(:oauth_token, user: user, scopes: ["read:accounts"]))
 588         |> get("/api/v1/accounts/#{user.id}/following")
 589
 590       refute [] == json_response(conn, 200)
 591     end
 592
 593     test "getting following, pagination", %{user: user, conn: conn} do
 594       following1 = insert(:user)
 595       following2 = insert(:user)
 596       following3 = insert(:user)
 597       {:ok, _} = User.follow(user, following1)
 598       {:ok, _} = User.follow(user, following2)
 599       {:ok, _} = User.follow(user, following3)
 600
 601       res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?since_id=#{following1.id}")
 602
 603       assert [%{"id" => id3}, %{"id" => id2}] = json_response(res_conn, 200)
 604       assert id3 == following3.id
 605       assert id2 == following2.id
 606
 607       res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?max_id=#{following3.id}")
 608
 609       assert [%{"id" => id2}, %{"id" => id1}] = json_response(res_conn, 200)
 610       assert id2 == following2.id
 611       assert id1 == following1.id
 612
 613       res_conn =
 614         get(conn, "/api/v1/accounts/#{user.id}/following?limit=1&max_id=#{following3.id}")
 615
 616       assert [%{"id" => id2}] = json_response(res_conn, 200)
 617       assert id2 == following2.id
 618
 619       assert [link_header] = get_resp_header(res_conn, "link")
 620       assert link_header =~ ~r/min_id=#{following2.id}/
 621       assert link_header =~ ~r/max_id=#{following2.id}/
 622     end
 623   end
 624
 625   describe "follow/unfollow" do
 626     setup do: oauth_access(["follow"])
 627
 628     test "following / unfollowing a user", %{conn: conn} do
 629       other_user = insert(:user)
 630
 631       ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/follow")
 632
 633       assert %{"id" => _id, "following" => true} = json_response(ret_conn, 200)
 634
 635       ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/unfollow")
 636
 637       assert %{"id" => _id, "following" => false} = json_response(ret_conn, 200)
 638
 639       conn = post(conn, "/api/v1/follows", %{"uri" => other_user.nickname})
 640
 641       assert %{"id" => id} = json_response(conn, 200)
 642       assert id == to_string(other_user.id)
 643     end
 644
 645     test "cancelling follow request", %{conn: conn} do
 646       %{id: other_user_id} = insert(:user, %{locked: true})
 647
 648       assert %{"id" => ^other_user_id, "following" => false, "requested" => true} =
 649                conn |> post("/api/v1/accounts/#{other_user_id}/follow") |> json_response(:ok)
 650
 651       assert %{"id" => ^other_user_id, "following" => false, "requested" => false} =
 652                conn |> post("/api/v1/accounts/#{other_user_id}/unfollow") |> json_response(:ok)
 653     end
 654
 655     test "following without reblogs" do
 656       %{conn: conn} = oauth_access(["follow", "read:statuses"])
 657       followed = insert(:user)
 658       other_user = insert(:user)
 659
 660       ret_conn = post(conn, "/api/v1/accounts/#{followed.id}/follow?reblogs=false")
 661
 662       assert %{"showing_reblogs" => false} = json_response(ret_conn, 200)
 663
 664       {:ok, activity} = CommonAPI.post(other_user, %{"status" => "hey"})
 665       {:ok, reblog, _} = CommonAPI.repeat(activity.id, followed)
 666
 667       ret_conn = get(conn, "/api/v1/timelines/home")
 668
 669       assert [] == json_response(ret_conn, 200)
 670
 671       ret_conn = post(conn, "/api/v1/accounts/#{followed.id}/follow?reblogs=true")
 672
 673       assert %{"showing_reblogs" => true} = json_response(ret_conn, 200)
 674
 675       conn = get(conn, "/api/v1/timelines/home")
 676
 677       expected_activity_id = reblog.id
 678       assert [%{"id" => ^expected_activity_id}] = json_response(conn, 200)
 679     end
 680
 681     test "following / unfollowing errors", %{user: user, conn: conn} do
 682       # self follow
 683       conn_res = post(conn, "/api/v1/accounts/#{user.id}/follow")
 684       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 685
 686       # self unfollow
 687       user = User.get_cached_by_id(user.id)
 688       conn_res = post(conn, "/api/v1/accounts/#{user.id}/unfollow")
 689       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 690
 691       # self follow via uri
 692       user = User.get_cached_by_id(user.id)
 693       conn_res = post(conn, "/api/v1/follows", %{"uri" => user.nickname})
 694       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 695
 696       # follow non existing user
 697       conn_res = post(conn, "/api/v1/accounts/doesntexist/follow")
 698       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 699
 700       # follow non existing user via uri
 701       conn_res = post(conn, "/api/v1/follows", %{"uri" => "doesntexist"})
 702       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 703
 704       # unfollow non existing user
 705       conn_res = post(conn, "/api/v1/accounts/doesntexist/unfollow")
 706       assert %{"error" => "Record not found"} = json_response(conn_res, 404)
 707     end
 708   end
 709
 710   describe "mute/unmute" do
 711     setup do: oauth_access(["write:mutes"])
 712
 713     test "with notifications", %{conn: conn} do
 714       other_user = insert(:user)
 715
 716       ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/mute")
 717
 718       response = json_response(ret_conn, 200)
 719
 720       assert %{"id" => _id, "muting" => true, "muting_notifications" => true} = response
 721
 722       conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")
 723
 724       response = json_response(conn, 200)
 725       assert %{"id" => _id, "muting" => false, "muting_notifications" => false} = response
 726     end
 727
 728     test "without notifications", %{conn: conn} do
 729       other_user = insert(:user)
 730
 731       ret_conn =
 732         post(conn, "/api/v1/accounts/#{other_user.id}/mute", %{"notifications" => "false"})
 733
 734       response = json_response(ret_conn, 200)
 735
 736       assert %{"id" => _id, "muting" => true, "muting_notifications" => false} = response
 737
 738       conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")
 739
 740       response = json_response(conn, 200)
 741       assert %{"id" => _id, "muting" => false, "muting_notifications" => false} = response
 742     end
 743   end
 744
 745   describe "pinned statuses" do
 746     setup do
 747       user = insert(:user)
 748       {:ok, activity} = CommonAPI.post(user, %{"status" => "HI!!!"})
 749       %{conn: conn} = oauth_access(["read:statuses"], user: user)
 750
 751       [conn: conn, user: user, activity: activity]
 752     end
 753
 754     test "returns pinned statuses", %{conn: conn, user: user, activity: activity} do
 755       {:ok, _} = CommonAPI.pin(activity.id, user)
 756
 757       result =
 758         conn
 759         |> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
 760         |> json_response(200)
 761
 762       id_str = to_string(activity.id)
 763
 764       assert [%{"id" => ^id_str, "pinned" => true}] = result
 765     end
 766   end
 767
 768   test "blocking / unblocking a user" do
 769     %{conn: conn} = oauth_access(["follow"])
 770     other_user = insert(:user)
 771
 772     ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/block")
 773
 774     assert %{"id" => _id, "blocking" => true} = json_response(ret_conn, 200)
 775
 776     conn = post(conn, "/api/v1/accounts/#{other_user.id}/unblock")
 777
 778     assert %{"id" => _id, "blocking" => false} = json_response(conn, 200)
 779   end
 780
 781   describe "create account by app" do
 782     setup do
 783       valid_params = %{
 784         username: "lain",
 785         email: "lain@example.org",
 786         password: "PlzDontHackLain",
 787         agreement: true
 788       }
 789
 790       [valid_params: valid_params]
 791     end
 792
 793     setup do: clear_config([:instance, :account_activation_required])
 794
 795     test "Account registration via Application", %{conn: conn} do
 796       conn =
 797         post(conn, "/api/v1/apps", %{
 798           client_name: "client_name",
 799           redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
 800           scopes: "read, write, follow"
 801         })
 802
 803       %{
 804         "client_id" => client_id,
 805         "client_secret" => client_secret,
 806         "id" => _,
 807         "name" => "client_name",
 808         "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
 809         "vapid_key" => _,
 810         "website" => nil
 811       } = json_response(conn, 200)
 812
 813       conn =
 814         post(conn, "/oauth/token", %{
 815           grant_type: "client_credentials",
 816           client_id: client_id,
 817           client_secret: client_secret
 818         })
 819
 820       assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
 821                json_response(conn, 200)
 822
 823       assert token
 824       token_from_db = Repo.get_by(Token, token: token)
 825       assert token_from_db
 826       assert refresh
 827       assert scope == "read write follow"
 828
 829       conn =
 830         build_conn()
 831         |> put_req_header("authorization", "Bearer " <> token)
 832         |> post("/api/v1/accounts", %{
 833           username: "lain",
 834           email: "lain@example.org",
 835           password: "PlzDontHackLain",
 836           bio: "Test Bio",
 837           agreement: true
 838         })
 839
 840       %{
 841         "access_token" => token,
 842         "created_at" => _created_at,
 843         "scope" => _scope,
 844         "token_type" => "Bearer"
 845       } = json_response(conn, 200)
 846
 847       token_from_db = Repo.get_by(Token, token: token)
 848       assert token_from_db
 849       token_from_db = Repo.preload(token_from_db, :user)
 850       assert token_from_db.user
 851
 852       assert token_from_db.user.confirmation_pending
 853     end
 854
 855     test "returns error when user already registred", %{conn: conn, valid_params: valid_params} do
 856       _user = insert(:user, email: "lain@example.org")
 857       app_token = insert(:oauth_token, user: nil)
 858
 859       conn =
 860         conn
 861         |> put_req_header("authorization", "Bearer " <> app_token.token)
 862
 863       res = post(conn, "/api/v1/accounts", valid_params)
 864       assert json_response(res, 400) == %{"error" => "{\"email\":[\"has already been taken\"]}"}
 865     end
 866
 867     test "returns bad_request if missing required params", %{
 868       conn: conn,
 869       valid_params: valid_params
 870     } do
 871       app_token = insert(:oauth_token, user: nil)
 872
 873       conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
 874
 875       res = post(conn, "/api/v1/accounts", valid_params)
 876       assert json_response(res, 200)
 877
 878       [{127, 0, 0, 1}, {127, 0, 0, 2}, {127, 0, 0, 3}, {127, 0, 0, 4}]
 879       |> Stream.zip(Map.delete(valid_params, :email))
 880       |> Enum.each(fn {ip, {attr, _}} ->
 881         res =
 882           conn
 883           |> Map.put(:remote_ip, ip)
 884           |> post("/api/v1/accounts", Map.delete(valid_params, attr))
 885           |> json_response(400)
 886
 887         assert res == %{"error" => "Missing parameters"}
 888       end)
 889     end
 890
 891     setup do: clear_config([:instance, :account_activation_required])
 892
 893     test "returns bad_request if missing email params when :account_activation_required is enabled",
 894          %{conn: conn, valid_params: valid_params} do
 895       Pleroma.Config.put([:instance, :account_activation_required], true)
 896
 897       app_token = insert(:oauth_token, user: nil)
 898       conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
 899
 900       res =
 901         conn
 902         |> Map.put(:remote_ip, {127, 0, 0, 5})
 903         |> post("/api/v1/accounts", Map.delete(valid_params, :email))
 904
 905       assert json_response(res, 400) == %{"error" => "Missing parameters"}
 906
 907       res =
 908         conn
 909         |> Map.put(:remote_ip, {127, 0, 0, 6})
 910         |> post("/api/v1/accounts", Map.put(valid_params, :email, ""))
 911
 912       assert json_response(res, 400) == %{"error" => "{\"email\":[\"can't be blank\"]}"}
 913     end
 914
 915     test "allow registration without an email", %{conn: conn, valid_params: valid_params} do
 916       app_token = insert(:oauth_token, user: nil)
 917       conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
 918
 919       res =
 920         conn
 921         |> Map.put(:remote_ip, {127, 0, 0, 7})
 922         |> post("/api/v1/accounts", Map.delete(valid_params, :email))
 923
 924       assert json_response(res, 200)
 925     end
 926
 927     test "allow registration with an empty email", %{conn: conn, valid_params: valid_params} do
 928       app_token = insert(:oauth_token, user: nil)
 929       conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
 930
 931       res =
 932         conn
 933         |> Map.put(:remote_ip, {127, 0, 0, 8})
 934         |> post("/api/v1/accounts", Map.put(valid_params, :email, ""))
 935
 936       assert json_response(res, 200)
 937     end
 938
 939     test "returns forbidden if token is invalid", %{conn: conn, valid_params: valid_params} do
 940       conn = put_req_header(conn, "authorization", "Bearer " <> "invalid-token")
 941
 942       res = post(conn, "/api/v1/accounts", valid_params)
 943       assert json_response(res, 403) == %{"error" => "Invalid credentials"}
 944     end
 945   end
 946
 947   describe "create account by app / rate limit" do
 948     setup do: clear_config([:rate_limit, :app_account_creation], {10_000, 2})
 949
 950     test "respects rate limit setting", %{conn: conn} do
 951       app_token = insert(:oauth_token, user: nil)
 952
 953       conn =
 954         conn
 955         |> put_req_header("authorization", "Bearer " <> app_token.token)
 956         |> Map.put(:remote_ip, {15, 15, 15, 15})
 957
 958       for i <- 1..2 do
 959         conn =
 960           post(conn, "/api/v1/accounts", %{
 961             username: "#{i}lain",
 962             email: "#{i}lain@example.org",
 963             password: "PlzDontHackLain",
 964             agreement: true
 965           })
 966
 967         %{
 968           "access_token" => token,
 969           "created_at" => _created_at,
 970           "scope" => _scope,
 971           "token_type" => "Bearer"
 972         } = json_response(conn, 200)
 973
 974         token_from_db = Repo.get_by(Token, token: token)
 975         assert token_from_db
 976         token_from_db = Repo.preload(token_from_db, :user)
 977         assert token_from_db.user
 978
 979         assert token_from_db.user.confirmation_pending
 980       end
 981
 982       conn =
 983         post(conn, "/api/v1/accounts", %{
 984           username: "6lain",
 985           email: "6lain@example.org",
 986           password: "PlzDontHackLain",
 987           agreement: true
 988         })
 989
 990       assert json_response(conn, :too_many_requests) == %{"error" => "Throttled"}
 991     end
 992   end
 993
 994   describe "GET /api/v1/accounts/:id/lists - account_lists" do
 995     test "returns lists to which the account belongs" do
 996       %{user: user, conn: conn} = oauth_access(["read:lists"])
 997       other_user = insert(:user)
 998       assert {:ok, %Pleroma.List{} = list} = Pleroma.List.create("Test List", user)
 999       {:ok, %{following: _following}} = Pleroma.List.follow(list, other_user)
1000
1001       res =
1002         conn
1003         |> get("/api/v1/accounts/#{other_user.id}/lists")
1004         |> json_response(200)
1005
1006       assert res == [%{"id" => to_string(list.id), "title" => "Test List"}]
1007     end
1008   end
1009
1010   describe "verify_credentials" do
1011     test "verify_credentials" do
1012       %{user: user, conn: conn} = oauth_access(["read:accounts"])
1013       conn = get(conn, "/api/v1/accounts/verify_credentials")
1014
1015       response = json_response(conn, 200)
1016
1017       assert %{"id" => id, "source" => %{"privacy" => "public"}} = response
1018       assert response["pleroma"]["chat_token"]
1019       assert id == to_string(user.id)
1020     end
1021
1022     test "verify_credentials default scope unlisted" do
1023       user = insert(:user, default_scope: "unlisted")
1024       %{conn: conn} = oauth_access(["read:accounts"], user: user)
1025
1026       conn = get(conn, "/api/v1/accounts/verify_credentials")
1027
1028       assert %{"id" => id, "source" => %{"privacy" => "unlisted"}} = json_response(conn, 200)
1029       assert id == to_string(user.id)
1030     end
1031
1032     test "locked accounts" do
1033       user = insert(:user, default_scope: "private")
1034       %{conn: conn} = oauth_access(["read:accounts"], user: user)
1035
1036       conn = get(conn, "/api/v1/accounts/verify_credentials")
1037
1038       assert %{"id" => id, "source" => %{"privacy" => "private"}} = json_response(conn, 200)
1039       assert id == to_string(user.id)
1040     end
1041   end
1042
1043   describe "user relationships" do
1044     setup do: oauth_access(["read:follows"])
1045
1046     test "returns the relationships for the current user", %{user: user, conn: conn} do
1047       other_user = insert(:user)
1048       {:ok, _user} = User.follow(user, other_user)
1049
1050       conn = get(conn, "/api/v1/accounts/relationships", %{"id" => [other_user.id]})
1051
1052       assert [relationship] = json_response(conn, 200)
1053
1054       assert to_string(other_user.id) == relationship["id"]
1055     end
1056
1057     test "returns an empty list on a bad request", %{conn: conn} do
1058       conn = get(conn, "/api/v1/accounts/relationships", %{})
1059
1060       assert [] = json_response(conn, 200)
1061     end
1062   end
1063
1064   test "getting a list of mutes" do
1065     %{user: user, conn: conn} = oauth_access(["read:mutes"])
1066     other_user = insert(:user)
1067
1068     {:ok, _user_relationships} = User.mute(user, other_user)
1069
1070     conn = get(conn, "/api/v1/mutes")
1071
1072     other_user_id = to_string(other_user.id)
1073     assert [%{"id" => ^other_user_id}] = json_response(conn, 200)
1074   end
1075
1076   test "getting a list of blocks" do
1077     %{user: user, conn: conn} = oauth_access(["read:blocks"])
1078     other_user = insert(:user)
1079
1080     {:ok, _user_relationship} = User.block(user, other_user)
1081
1082     conn =
1083       conn
1084       |> assign(:user, user)
1085       |> get("/api/v1/blocks")
1086
1087     other_user_id = to_string(other_user.id)
1088     assert [%{"id" => ^other_user_id}] = json_response(conn, 200)
1089   end
1090 end