git.squeep.com Git - akkoma/blob - test/web/mastodon_api/controllers/account_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.AccountControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   alias Pleroma.Config
   9   alias Pleroma.Repo
  10   alias Pleroma.User
  11   alias Pleroma.Web.ActivityPub.ActivityPub
  12   alias Pleroma.Web.ActivityPub.InternalFetchActor
  13   alias Pleroma.Web.CommonAPI
  14   alias Pleroma.Web.OAuth.Token
  15
  16   import Pleroma.Factory
  17
  18   describe "account fetching" do
  19     setup do: clear_config([:instance, :limit_to_local_content])
  20
  21     test "works by id" do
  22       %User{id: user_id} = insert(:user)
  23
  24       assert %{"id" => ^user_id} =
  25                build_conn()
  26                |> get("/api/v1/accounts/#{user_id}")
  27                |> json_response_and_validate_schema(200)
  28
  29       assert %{"error" => "Can't find user"} =
  30                build_conn()
  31                |> get("/api/v1/accounts/-1")
  32                |> json_response_and_validate_schema(404)
  33     end
  34
  35     test "works by nickname" do
  36       user = insert(:user)
  37
  38       assert %{"id" => user_id} =
  39                build_conn()
  40                |> get("/api/v1/accounts/#{user.nickname}")
  41                |> json_response_and_validate_schema(200)
  42     end
  43
  44     test "works by nickname for remote users" do
  45       Config.put([:instance, :limit_to_local_content], false)
  46
  47       user = insert(:user, nickname: "user@example.com", local: false)
  48
  49       assert %{"id" => user_id} =
  50                build_conn()
  51                |> get("/api/v1/accounts/#{user.nickname}")
  52                |> json_response_and_validate_schema(200)
  53     end
  54
  55     test "respects limit_to_local_content == :all for remote user nicknames" do
  56       Config.put([:instance, :limit_to_local_content], :all)
  57
  58       user = insert(:user, nickname: "user@example.com", local: false)
  59
  60       assert build_conn()
  61              |> get("/api/v1/accounts/#{user.nickname}")
  62              |> json_response_and_validate_schema(404)
  63     end
  64
  65     test "respects limit_to_local_content == :unauthenticated for remote user nicknames" do
  66       Config.put([:instance, :limit_to_local_content], :unauthenticated)
  67
  68       user = insert(:user, nickname: "user@example.com", local: false)
  69       reading_user = insert(:user)
  70
  71       conn =
  72         build_conn()
  73         |> get("/api/v1/accounts/#{user.nickname}")
  74
  75       assert json_response_and_validate_schema(conn, 404)
  76
  77       conn =
  78         build_conn()
  79         |> assign(:user, reading_user)
  80         |> assign(:token, insert(:oauth_token, user: reading_user, scopes: ["read:accounts"]))
  81         |> get("/api/v1/accounts/#{user.nickname}")
  82
  83       assert %{"id" => id} = json_response_and_validate_schema(conn, 200)
  84       assert id == user.id
  85     end
  86
  87     test "accounts fetches correct account for nicknames beginning with numbers", %{conn: conn} do
  88       # Need to set an old-style integer ID to reproduce the problem
  89       # (these are no longer assigned to new accounts but were preserved
  90       # for existing accounts during the migration to flakeIDs)
  91       user_one = insert(:user, %{id: 1212})
  92       user_two = insert(:user, %{nickname: "#{user_one.id}garbage"})
  93
  94       acc_one =
  95         conn
  96         |> get("/api/v1/accounts/#{user_one.id}")
  97         |> json_response_and_validate_schema(:ok)
  98
  99       acc_two =
 100         conn
 101         |> get("/api/v1/accounts/#{user_two.nickname}")
 102         |> json_response_and_validate_schema(:ok)
 103
 104       acc_three =
 105         conn
 106         |> get("/api/v1/accounts/#{user_two.id}")
 107         |> json_response_and_validate_schema(:ok)
 108
 109       refute acc_one == acc_two
 110       assert acc_two == acc_three
 111     end
 112
 113     test "returns 404 when user is invisible", %{conn: conn} do
 114       user = insert(:user, %{invisible: true})
 115
 116       assert %{"error" => "Can't find user"} =
 117                conn
 118                |> get("/api/v1/accounts/#{user.nickname}")
 119                |> json_response_and_validate_schema(404)
 120     end
 121
 122     test "returns 404 for internal.fetch actor", %{conn: conn} do
 123       %User{nickname: "internal.fetch"} = InternalFetchActor.get_actor()
 124
 125       assert %{"error" => "Can't find user"} =
 126                conn
 127                |> get("/api/v1/accounts/internal.fetch")
 128                |> json_response_and_validate_schema(404)
 129     end
 130
 131     test "returns 404 for deactivated user", %{conn: conn} do
 132       user = insert(:user, deactivated: true)
 133
 134       assert %{"error" => "Can't find user"} =
 135                conn
 136                |> get("/api/v1/accounts/#{user.id}")
 137                |> json_response_and_validate_schema(:not_found)
 138     end
 139   end
 140
 141   defp local_and_remote_users do
 142     local = insert(:user)
 143     remote = insert(:user, local: false)
 144     {:ok, local: local, remote: remote}
 145   end
 146
 147   describe "user fetching with restrict unauthenticated profiles for local and remote" do
 148     setup do: local_and_remote_users()
 149
 150     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 151
 152     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 153
 154     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 155       assert %{"error" => "This API requires an authenticated user"} ==
 156                conn
 157                |> get("/api/v1/accounts/#{local.id}")
 158                |> json_response_and_validate_schema(:unauthorized)
 159
 160       assert %{"error" => "This API requires an authenticated user"} ==
 161                conn
 162                |> get("/api/v1/accounts/#{remote.id}")
 163                |> json_response_and_validate_schema(:unauthorized)
 164     end
 165
 166     test "if user is authenticated", %{local: local, remote: remote} do
 167       %{conn: conn} = oauth_access(["read"])
 168
 169       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 170       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 171
 172       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 173       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 174     end
 175   end
 176
 177   describe "user fetching with restrict unauthenticated profiles for local" do
 178     setup do: local_and_remote_users()
 179
 180     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 181
 182     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 183       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 184
 185       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 186                "error" => "This API requires an authenticated user"
 187              }
 188
 189       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 190       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 191     end
 192
 193     test "if user is authenticated", %{local: local, remote: remote} do
 194       %{conn: conn} = oauth_access(["read"])
 195
 196       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 197       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 198
 199       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 200       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 201     end
 202   end
 203
 204   describe "user fetching with restrict unauthenticated profiles for remote" do
 205     setup do: local_and_remote_users()
 206
 207     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 208
 209     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 210       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 211       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 212
 213       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 214
 215       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 216                "error" => "This API requires an authenticated user"
 217              }
 218     end
 219
 220     test "if user is authenticated", %{local: local, remote: remote} do
 221       %{conn: conn} = oauth_access(["read"])
 222
 223       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 224       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 225
 226       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 227       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 228     end
 229   end
 230
 231   describe "user timelines" do
 232     setup do: oauth_access(["read:statuses"])
 233
 234     test "works with announces that are just addressed to public", %{conn: conn} do
 235       user = insert(:user, ap_id: "https://honktest/u/test", local: false)
 236       other_user = insert(:user)
 237
 238       {:ok, post} = CommonAPI.post(other_user, %{status: "bonkeronk"})
 239
 240       {:ok, announce, _} =
 241         %{
 242           "@context" => "https://www.w3.org/ns/activitystreams",
 243           "actor" => "https://honktest/u/test",
 244           "id" => "https://honktest/u/test/bonk/1793M7B9MQ48847vdx",
 245           "object" => post.data["object"],
 246           "published" => "2019-06-25T19:33:58Z",
 247           "to" => ["https://www.w3.org/ns/activitystreams#Public"],
 248           "type" => "Announce"
 249         }
 250         |> ActivityPub.persist(local: false)
 251
 252       assert resp =
 253                conn
 254                |> get("/api/v1/accounts/#{user.id}/statuses")
 255                |> json_response_and_validate_schema(200)
 256
 257       assert [%{"id" => id}] = resp
 258       assert id == announce.id
 259     end
 260
 261     test "deactivated user", %{conn: conn} do
 262       user = insert(:user, deactivated: true)
 263
 264       assert %{"error" => "Can't find user"} ==
 265                conn
 266                |> get("/api/v1/accounts/#{user.id}/statuses")
 267                |> json_response_and_validate_schema(:not_found)
 268     end
 269
 270     test "returns 404 when user is invisible", %{conn: conn} do
 271       user = insert(:user, %{invisible: true})
 272
 273       assert %{"error" => "Can't find user"} =
 274                conn
 275                |> get("/api/v1/accounts/#{user.id}")
 276                |> json_response_and_validate_schema(404)
 277     end
 278
 279     test "respects blocks", %{user: user_one, conn: conn} do
 280       user_two = insert(:user)
 281       user_three = insert(:user)
 282
 283       User.block(user_one, user_two)
 284
 285       {:ok, activity} = CommonAPI.post(user_two, %{status: "User one sux0rz"})
 286       {:ok, repeat} = CommonAPI.repeat(activity.id, user_three)
 287
 288       assert resp =
 289                conn
 290                |> get("/api/v1/accounts/#{user_two.id}/statuses")
 291                |> json_response_and_validate_schema(200)
 292
 293       assert [%{"id" => id}] = resp
 294       assert id == activity.id
 295
 296       # Even a blocked user will deliver the full user timeline, there would be
 297       #   no point in looking at a blocked users timeline otherwise
 298       assert resp =
 299                conn
 300                |> get("/api/v1/accounts/#{user_two.id}/statuses")
 301                |> json_response_and_validate_schema(200)
 302
 303       assert [%{"id" => id}] = resp
 304       assert id == activity.id
 305
 306       # Third user's timeline includes the repeat when viewed by unauthenticated user
 307       resp =
 308         build_conn()
 309         |> get("/api/v1/accounts/#{user_three.id}/statuses")
 310         |> json_response_and_validate_schema(200)
 311
 312       assert [%{"id" => id}] = resp
 313       assert id == repeat.id
 314
 315       # When viewing a third user's timeline, the blocked users' statuses will NOT be shown
 316       resp = get(conn, "/api/v1/accounts/#{user_three.id}/statuses")
 317
 318       assert [] == json_response_and_validate_schema(resp, 200)
 319     end
 320
 321     test "gets users statuses", %{conn: conn} do
 322       user_one = insert(:user)
 323       user_two = insert(:user)
 324       user_three = insert(:user)
 325
 326       {:ok, _user_three} = User.follow(user_three, user_one)
 327
 328       {:ok, activity} = CommonAPI.post(user_one, %{status: "HI!!!"})
 329
 330       {:ok, direct_activity} =
 331         CommonAPI.post(user_one, %{
 332           status: "Hi, @#{user_two.nickname}.",
 333           visibility: "direct"
 334         })
 335
 336       {:ok, private_activity} =
 337         CommonAPI.post(user_one, %{status: "private", visibility: "private"})
 338
 339       # TODO!!!
 340       resp =
 341         conn
 342         |> get("/api/v1/accounts/#{user_one.id}/statuses")
 343         |> json_response_and_validate_schema(200)
 344
 345       assert [%{"id" => id}] = resp
 346       assert id == to_string(activity.id)
 347
 348       resp =
 349         conn
 350         |> assign(:user, user_two)
 351         |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
 352         |> get("/api/v1/accounts/#{user_one.id}/statuses")
 353         |> json_response_and_validate_schema(200)
 354
 355       assert [%{"id" => id_one}, %{"id" => id_two}] = resp
 356       assert id_one == to_string(direct_activity.id)
 357       assert id_two == to_string(activity.id)
 358
 359       resp =
 360         conn
 361         |> assign(:user, user_three)
 362         |> assign(:token, insert(:oauth_token, user: user_three, scopes: ["read:statuses"]))
 363         |> get("/api/v1/accounts/#{user_one.id}/statuses")
 364         |> json_response_and_validate_schema(200)
 365
 366       assert [%{"id" => id_one}, %{"id" => id_two}] = resp
 367       assert id_one == to_string(private_activity.id)
 368       assert id_two == to_string(activity.id)
 369     end
 370
 371     test "unimplemented pinned statuses feature", %{conn: conn} do
 372       note = insert(:note_activity)
 373       user = User.get_cached_by_ap_id(note.data["actor"])
 374
 375       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?pinned=true")
 376
 377       assert json_response_and_validate_schema(conn, 200) == []
 378     end
 379
 380     test "gets an users media, excludes reblogs", %{conn: conn} do
 381       note = insert(:note_activity)
 382       user = User.get_cached_by_ap_id(note.data["actor"])
 383       other_user = insert(:user)
 384
 385       file = %Plug.Upload{
 386         content_type: "image/jpg",
 387         path: Path.absname("test/fixtures/image.jpg"),
 388         filename: "an_image.jpg"
 389       }
 390
 391       {:ok, %{id: media_id}} = ActivityPub.upload(file, actor: user.ap_id)
 392
 393       {:ok, %{id: image_post_id}} = CommonAPI.post(user, %{status: "cofe", media_ids: [media_id]})
 394
 395       {:ok, %{id: media_id}} = ActivityPub.upload(file, actor: other_user.ap_id)
 396
 397       {:ok, %{id: other_image_post_id}} =
 398         CommonAPI.post(other_user, %{status: "cofe2", media_ids: [media_id]})
 399
 400       {:ok, _announce} = CommonAPI.repeat(other_image_post_id, user)
 401
 402       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?only_media=true")
 403
 404       assert [%{"id" => ^image_post_id}] = json_response_and_validate_schema(conn, 200)
 405
 406       conn = get(build_conn(), "/api/v1/accounts/#{user.id}/statuses?only_media=1")
 407
 408       assert [%{"id" => ^image_post_id}] = json_response_and_validate_schema(conn, 200)
 409     end
 410
 411     test "gets a user's statuses without reblogs", %{user: user, conn: conn} do
 412       {:ok, %{id: post_id}} = CommonAPI.post(user, %{status: "HI!!!"})
 413       {:ok, _} = CommonAPI.repeat(post_id, user)
 414
 415       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_reblogs=true")
 416       assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)
 417
 418       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_reblogs=1")
 419       assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)
 420     end
 421
 422     test "filters user's statuses by a hashtag", %{user: user, conn: conn} do
 423       {:ok, %{id: post_id}} = CommonAPI.post(user, %{status: "#hashtag"})
 424       {:ok, _post} = CommonAPI.post(user, %{status: "hashtag"})
 425
 426       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?tagged=hashtag")
 427       assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)
 428     end
 429
 430     test "the user views their own timelines and excludes direct messages", %{
 431       user: user,
 432       conn: conn
 433     } do
 434       {:ok, %{id: public_activity_id}} =
 435         CommonAPI.post(user, %{status: ".", visibility: "public"})
 436
 437       {:ok, _direct_activity} = CommonAPI.post(user, %{status: ".", visibility: "direct"})
 438
 439       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_visibilities[]=direct")
 440       assert [%{"id" => ^public_activity_id}] = json_response_and_validate_schema(conn, 200)
 441     end
 442   end
 443
 444   defp local_and_remote_activities(%{local: local, remote: remote}) do
 445     insert(:note_activity, user: local)
 446     insert(:note_activity, user: remote, local: false)
 447
 448     :ok
 449   end
 450
 451   describe "statuses with restrict unauthenticated profiles for local and remote" do
 452     setup do: local_and_remote_users()
 453     setup :local_and_remote_activities
 454
 455     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 456
 457     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 458
 459     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 460       assert %{"error" => "This API requires an authenticated user"} ==
 461                conn
 462                |> get("/api/v1/accounts/#{local.id}/statuses")
 463                |> json_response_and_validate_schema(:unauthorized)
 464
 465       assert %{"error" => "This API requires an authenticated user"} ==
 466                conn
 467                |> get("/api/v1/accounts/#{remote.id}/statuses")
 468                |> json_response_and_validate_schema(:unauthorized)
 469     end
 470
 471     test "if user is authenticated", %{local: local, remote: remote} do
 472       %{conn: conn} = oauth_access(["read"])
 473
 474       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 475       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 476
 477       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 478       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 479     end
 480   end
 481
 482   describe "statuses with restrict unauthenticated profiles for local" do
 483     setup do: local_and_remote_users()
 484     setup :local_and_remote_activities
 485
 486     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 487
 488     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 489       assert %{"error" => "This API requires an authenticated user"} ==
 490                conn
 491                |> get("/api/v1/accounts/#{local.id}/statuses")
 492                |> json_response_and_validate_schema(:unauthorized)
 493
 494       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 495       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 496     end
 497
 498     test "if user is authenticated", %{local: local, remote: remote} do
 499       %{conn: conn} = oauth_access(["read"])
 500
 501       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 502       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 503
 504       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 505       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 506     end
 507   end
 508
 509   describe "statuses with restrict unauthenticated profiles for remote" do
 510     setup do: local_and_remote_users()
 511     setup :local_and_remote_activities
 512
 513     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 514
 515     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 516       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 517       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 518
 519       assert %{"error" => "This API requires an authenticated user"} ==
 520                conn
 521                |> get("/api/v1/accounts/#{remote.id}/statuses")
 522                |> json_response_and_validate_schema(:unauthorized)
 523     end
 524
 525     test "if user is authenticated", %{local: local, remote: remote} do
 526       %{conn: conn} = oauth_access(["read"])
 527
 528       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 529       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 530
 531       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 532       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 533     end
 534   end
 535
 536   describe "followers" do
 537     setup do: oauth_access(["read:accounts"])
 538
 539     test "getting followers", %{user: user, conn: conn} do
 540       other_user = insert(:user)
 541       {:ok, %{id: user_id}} = User.follow(user, other_user)
 542
 543       conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")
 544
 545       assert [%{"id" => ^user_id}] = json_response_and_validate_schema(conn, 200)
 546     end
 547
 548     test "getting followers, hide_followers", %{user: user, conn: conn} do
 549       other_user = insert(:user, hide_followers: true)
 550       {:ok, _user} = User.follow(user, other_user)
 551
 552       conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")
 553
 554       assert [] == json_response_and_validate_schema(conn, 200)
 555     end
 556
 557     test "getting followers, hide_followers, same user requesting" do
 558       user = insert(:user)
 559       other_user = insert(:user, hide_followers: true)
 560       {:ok, _user} = User.follow(user, other_user)
 561
 562       conn =
 563         build_conn()
 564         |> assign(:user, other_user)
 565         |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
 566         |> get("/api/v1/accounts/#{other_user.id}/followers")
 567
 568       refute [] == json_response_and_validate_schema(conn, 200)
 569     end
 570
 571     test "getting followers, pagination", %{user: user, conn: conn} do
 572       {:ok, %User{id: follower1_id}} = :user |> insert() |> User.follow(user)
 573       {:ok, %User{id: follower2_id}} = :user |> insert() |> User.follow(user)
 574       {:ok, %User{id: follower3_id}} = :user |> insert() |> User.follow(user)
 575
 576       assert [%{"id" => ^follower3_id}, %{"id" => ^follower2_id}] =
 577                conn
 578                |> get("/api/v1/accounts/#{user.id}/followers?since_id=#{follower1_id}")
 579                |> json_response_and_validate_schema(200)
 580
 581       assert [%{"id" => ^follower2_id}, %{"id" => ^follower1_id}] =
 582                conn
 583                |> get("/api/v1/accounts/#{user.id}/followers?max_id=#{follower3_id}")
 584                |> json_response_and_validate_schema(200)
 585
 586       assert [%{"id" => ^follower2_id}, %{"id" => ^follower1_id}] =
 587                conn
 588                |> get(
 589                  "/api/v1/accounts/#{user.id}/followers?id=#{user.id}&limit=20&max_id=#{
 590                    follower3_id
 591                  }"
 592                )
 593                |> json_response_and_validate_schema(200)
 594
 595       res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?limit=1&max_id=#{follower3_id}")
 596
 597       assert [%{"id" => ^follower2_id}] = json_response_and_validate_schema(res_conn, 200)
 598
 599       assert [link_header] = get_resp_header(res_conn, "link")
 600       assert link_header =~ ~r/min_id=#{follower2_id}/
 601       assert link_header =~ ~r/max_id=#{follower2_id}/
 602     end
 603   end
 604
 605   describe "following" do
 606     setup do: oauth_access(["read:accounts"])
 607
 608     test "getting following", %{user: user, conn: conn} do
 609       other_user = insert(:user)
 610       {:ok, user} = User.follow(user, other_user)
 611
 612       conn = get(conn, "/api/v1/accounts/#{user.id}/following")
 613
 614       assert [%{"id" => id}] = json_response_and_validate_schema(conn, 200)
 615       assert id == to_string(other_user.id)
 616     end
 617
 618     test "getting following, hide_follows, other user requesting" do
 619       user = insert(:user, hide_follows: true)
 620       other_user = insert(:user)
 621       {:ok, user} = User.follow(user, other_user)
 622
 623       conn =
 624         build_conn()
 625         |> assign(:user, other_user)
 626         |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
 627         |> get("/api/v1/accounts/#{user.id}/following")
 628
 629       assert [] == json_response_and_validate_schema(conn, 200)
 630     end
 631
 632     test "getting following, hide_follows, same user requesting" do
 633       user = insert(:user, hide_follows: true)
 634       other_user = insert(:user)
 635       {:ok, user} = User.follow(user, other_user)
 636
 637       conn =
 638         build_conn()
 639         |> assign(:user, user)
 640         |> assign(:token, insert(:oauth_token, user: user, scopes: ["read:accounts"]))
 641         |> get("/api/v1/accounts/#{user.id}/following")
 642
 643       refute [] == json_response_and_validate_schema(conn, 200)
 644     end
 645
 646     test "getting following, pagination", %{user: user, conn: conn} do
 647       following1 = insert(:user)
 648       following2 = insert(:user)
 649       following3 = insert(:user)
 650       {:ok, _} = User.follow(user, following1)
 651       {:ok, _} = User.follow(user, following2)
 652       {:ok, _} = User.follow(user, following3)
 653
 654       res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?since_id=#{following1.id}")
 655
 656       assert [%{"id" => id3}, %{"id" => id2}] = json_response_and_validate_schema(res_conn, 200)
 657       assert id3 == following3.id
 658       assert id2 == following2.id
 659
 660       res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?max_id=#{following3.id}")
 661
 662       assert [%{"id" => id2}, %{"id" => id1}] = json_response_and_validate_schema(res_conn, 200)
 663       assert id2 == following2.id
 664       assert id1 == following1.id
 665
 666       res_conn =
 667         get(
 668           conn,
 669           "/api/v1/accounts/#{user.id}/following?id=#{user.id}&limit=20&max_id=#{following3.id}"
 670         )
 671
 672       assert [%{"id" => id2}, %{"id" => id1}] = json_response_and_validate_schema(res_conn, 200)
 673       assert id2 == following2.id
 674       assert id1 == following1.id
 675
 676       res_conn =
 677         get(conn, "/api/v1/accounts/#{user.id}/following?limit=1&max_id=#{following3.id}")
 678
 679       assert [%{"id" => id2}] = json_response_and_validate_schema(res_conn, 200)
 680       assert id2 == following2.id
 681
 682       assert [link_header] = get_resp_header(res_conn, "link")
 683       assert link_header =~ ~r/min_id=#{following2.id}/
 684       assert link_header =~ ~r/max_id=#{following2.id}/
 685     end
 686   end
 687
 688   describe "follow/unfollow" do
 689     setup do: oauth_access(["follow"])
 690
 691     test "following / unfollowing a user", %{conn: conn} do
 692       %{id: other_user_id, nickname: other_user_nickname} = insert(:user)
 693
 694       assert %{"id" => _id, "following" => true} =
 695                conn
 696                |> post("/api/v1/accounts/#{other_user_id}/follow")
 697                |> json_response_and_validate_schema(200)
 698
 699       assert %{"id" => _id, "following" => false} =
 700                conn
 701                |> post("/api/v1/accounts/#{other_user_id}/unfollow")
 702                |> json_response_and_validate_schema(200)
 703
 704       assert %{"id" => ^other_user_id} =
 705                conn
 706                |> put_req_header("content-type", "application/json")
 707                |> post("/api/v1/follows", %{"uri" => other_user_nickname})
 708                |> json_response_and_validate_schema(200)
 709     end
 710
 711     test "cancelling follow request", %{conn: conn} do
 712       %{id: other_user_id} = insert(:user, %{locked: true})
 713
 714       assert %{"id" => ^other_user_id, "following" => false, "requested" => true} =
 715                conn
 716                |> post("/api/v1/accounts/#{other_user_id}/follow")
 717                |> json_response_and_validate_schema(:ok)
 718
 719       assert %{"id" => ^other_user_id, "following" => false, "requested" => false} =
 720                conn
 721                |> post("/api/v1/accounts/#{other_user_id}/unfollow")
 722                |> json_response_and_validate_schema(:ok)
 723     end
 724
 725     test "following without reblogs" do
 726       %{conn: conn} = oauth_access(["follow", "read:statuses"])
 727       followed = insert(:user)
 728       other_user = insert(:user)
 729
 730       ret_conn =
 731         conn
 732         |> put_req_header("content-type", "application/json")
 733         |> post("/api/v1/accounts/#{followed.id}/follow", %{reblogs: false})
 734
 735       assert %{"showing_reblogs" => false} = json_response_and_validate_schema(ret_conn, 200)
 736
 737       {:ok, activity} = CommonAPI.post(other_user, %{status: "hey"})
 738       {:ok, %{id: reblog_id}} = CommonAPI.repeat(activity.id, followed)
 739
 740       assert [] ==
 741                conn
 742                |> get("/api/v1/timelines/home")
 743                |> json_response(200)
 744
 745       assert %{"showing_reblogs" => true} =
 746                conn
 747                |> put_req_header("content-type", "application/json")
 748                |> post("/api/v1/accounts/#{followed.id}/follow", %{reblogs: true})
 749                |> json_response_and_validate_schema(200)
 750
 751       assert [%{"id" => ^reblog_id}] =
 752                conn
 753                |> get("/api/v1/timelines/home")
 754                |> json_response(200)
 755     end
 756
 757     test "following with reblogs" do
 758       %{conn: conn} = oauth_access(["follow", "read:statuses"])
 759       followed = insert(:user)
 760       other_user = insert(:user)
 761
 762       ret_conn = post(conn, "/api/v1/accounts/#{followed.id}/follow")
 763
 764       assert %{"showing_reblogs" => true} = json_response_and_validate_schema(ret_conn, 200)
 765
 766       {:ok, activity} = CommonAPI.post(other_user, %{status: "hey"})
 767       {:ok, %{id: reblog_id}} = CommonAPI.repeat(activity.id, followed)
 768
 769       assert [%{"id" => ^reblog_id}] =
 770                conn
 771                |> get("/api/v1/timelines/home")
 772                |> json_response(200)
 773
 774       assert %{"showing_reblogs" => false} =
 775                conn
 776                |> put_req_header("content-type", "application/json")
 777                |> post("/api/v1/accounts/#{followed.id}/follow", %{reblogs: false})
 778                |> json_response_and_validate_schema(200)
 779
 780       assert [] ==
 781                conn
 782                |> get("/api/v1/timelines/home")
 783                |> json_response(200)
 784     end
 785
 786     test "following / unfollowing errors", %{user: user, conn: conn} do
 787       # self follow
 788       conn_res = post(conn, "/api/v1/accounts/#{user.id}/follow")
 789
 790       assert %{"error" => "Can not follow yourself"} =
 791                json_response_and_validate_schema(conn_res, 400)
 792
 793       # self unfollow
 794       user = User.get_cached_by_id(user.id)
 795       conn_res = post(conn, "/api/v1/accounts/#{user.id}/unfollow")
 796
 797       assert %{"error" => "Can not unfollow yourself"} =
 798                json_response_and_validate_schema(conn_res, 400)
 799
 800       # self follow via uri
 801       user = User.get_cached_by_id(user.id)
 802
 803       assert %{"error" => "Can not follow yourself"} =
 804                conn
 805                |> put_req_header("content-type", "multipart/form-data")
 806                |> post("/api/v1/follows", %{"uri" => user.nickname})
 807                |> json_response_and_validate_schema(400)
 808
 809       # follow non existing user
 810       conn_res = post(conn, "/api/v1/accounts/doesntexist/follow")
 811       assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)
 812
 813       # follow non existing user via uri
 814       conn_res =
 815         conn
 816         |> put_req_header("content-type", "multipart/form-data")
 817         |> post("/api/v1/follows", %{"uri" => "doesntexist"})
 818
 819       assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)
 820
 821       # unfollow non existing user
 822       conn_res = post(conn, "/api/v1/accounts/doesntexist/unfollow")
 823       assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)
 824     end
 825   end
 826
 827   describe "mute/unmute" do
 828     setup do: oauth_access(["write:mutes"])
 829
 830     test "with notifications", %{conn: conn} do
 831       other_user = insert(:user)
 832
 833       assert %{"id" => _id, "muting" => true, "muting_notifications" => true} =
 834                conn
 835                |> post("/api/v1/accounts/#{other_user.id}/mute")
 836                |> json_response_and_validate_schema(200)
 837
 838       conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")
 839
 840       assert %{"id" => _id, "muting" => false, "muting_notifications" => false} =
 841                json_response_and_validate_schema(conn, 200)
 842     end
 843
 844     test "without notifications", %{conn: conn} do
 845       other_user = insert(:user)
 846
 847       ret_conn =
 848         conn
 849         |> put_req_header("content-type", "multipart/form-data")
 850         |> post("/api/v1/accounts/#{other_user.id}/mute", %{"notifications" => "false"})
 851
 852       assert %{"id" => _id, "muting" => true, "muting_notifications" => false} =
 853                json_response_and_validate_schema(ret_conn, 200)
 854
 855       conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")
 856
 857       assert %{"id" => _id, "muting" => false, "muting_notifications" => false} =
 858                json_response_and_validate_schema(conn, 200)
 859     end
 860   end
 861
 862   describe "pinned statuses" do
 863     setup do
 864       user = insert(:user)
 865       {:ok, activity} = CommonAPI.post(user, %{status: "HI!!!"})
 866       %{conn: conn} = oauth_access(["read:statuses"], user: user)
 867
 868       [conn: conn, user: user, activity: activity]
 869     end
 870
 871     test "returns pinned statuses", %{conn: conn, user: user, activity: %{id: activity_id}} do
 872       {:ok, _} = CommonAPI.pin(activity_id, user)
 873
 874       assert [%{"id" => ^activity_id, "pinned" => true}] =
 875                conn
 876                |> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
 877                |> json_response_and_validate_schema(200)
 878     end
 879   end
 880
 881   test "blocking / unblocking a user" do
 882     %{conn: conn} = oauth_access(["follow"])
 883     other_user = insert(:user)
 884
 885     ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/block")
 886
 887     assert %{"id" => _id, "blocking" => true} = json_response_and_validate_schema(ret_conn, 200)
 888
 889     conn = post(conn, "/api/v1/accounts/#{other_user.id}/unblock")
 890
 891     assert %{"id" => _id, "blocking" => false} = json_response_and_validate_schema(conn, 200)
 892   end
 893
 894   describe "create account by app" do
 895     setup do
 896       valid_params = %{
 897         username: "lain",
 898         email: "lain@example.org",
 899         password: "PlzDontHackLain",
 900         agreement: true
 901       }
 902
 903       [valid_params: valid_params]
 904     end
 905
 906     test "Account registration via Application, no confirmation required", %{conn: conn} do
 907       clear_config([:instance, :account_activation_required], false)
 908
 909       conn =
 910         conn
 911         |> put_req_header("content-type", "application/json")
 912         |> post("/api/v1/apps", %{
 913           client_name: "client_name",
 914           redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
 915           scopes: "read, write, follow"
 916         })
 917
 918       assert %{
 919                "client_id" => client_id,
 920                "client_secret" => client_secret,
 921                "id" => _,
 922                "name" => "client_name",
 923                "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
 924                "vapid_key" => _,
 925                "website" => nil
 926              } = json_response_and_validate_schema(conn, 200)
 927
 928       conn =
 929         post(conn, "/oauth/token", %{
 930           grant_type: "client_credentials",
 931           client_id: client_id,
 932           client_secret: client_secret
 933         })
 934
 935       assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
 936                json_response(conn, 200)
 937
 938       assert token
 939       token_from_db = Repo.get_by(Token, token: token)
 940       assert token_from_db
 941       assert refresh
 942       assert scope == "read write follow"
 943
 944       conn =
 945         build_conn()
 946         |> put_req_header("content-type", "multipart/form-data")
 947         |> put_req_header("authorization", "Bearer " <> token)
 948         |> post("/api/v1/accounts", %{
 949           username: "lain",
 950           email: "lain@example.org",
 951           password: "PlzDontHackLain",
 952           bio: "Test Bio",
 953           agreement: true
 954         })
 955
 956       %{
 957         "access_token" => token,
 958         "created_at" => _created_at,
 959         "scope" => ^scope,
 960         "token_type" => "Bearer"
 961       } = json_response_and_validate_schema(conn, 200)
 962
 963       token_from_db = Repo.get_by(Token, token: token)
 964       assert token_from_db
 965       token_from_db = Repo.preload(token_from_db, :user)
 966       assert token_from_db.user
 967       refute token_from_db.user.confirmation_pending
 968     end
 969
 970     setup do: clear_config([:instance, :account_approval_required])
 971
 972     test "Account registration via Application", %{conn: conn} do
 973       clear_config([:instance, :account_activation_required], true)
 974
 975       conn =
 976         conn
 977         |> put_req_header("content-type", "application/json")
 978         |> post("/api/v1/apps", %{
 979           client_name: "client_name",
 980           redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
 981           scopes: "read, write, follow"
 982         })
 983
 984       assert %{
 985                "client_id" => client_id,
 986                "client_secret" => client_secret,
 987                "id" => _,
 988                "name" => "client_name",
 989                "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
 990                "vapid_key" => _,
 991                "website" => nil
 992              } = json_response_and_validate_schema(conn, 200)
 993
 994       conn =
 995         post(conn, "/oauth/token", %{
 996           grant_type: "client_credentials",
 997           client_id: client_id,
 998           client_secret: client_secret
 999         })
1000
1001       assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
1002                json_response(conn, 200)
1003
1004       assert token
1005       token_from_db = Repo.get_by(Token, token: token)
1006       assert token_from_db
1007       assert refresh
1008       assert scope == "read write follow"
1009
1010       conn =
1011         build_conn()
1012         |> put_req_header("content-type", "multipart/form-data")
1013         |> put_req_header("authorization", "Bearer " <> token)
1014         |> post("/api/v1/accounts", %{
1015           username: "lain",
1016           email: "lain@example.org",
1017           password: "PlzDontHackLain",
1018           bio: "Test Bio",
1019           agreement: true
1020         })
1021
1022       %{
1023         "access_token" => token,
1024         "created_at" => _created_at,
1025         "scope" => ^scope,
1026         "token_type" => "Bearer"
1027       } = json_response_and_validate_schema(conn, 200)
1028
1029       token_from_db = Repo.get_by(Token, token: token)
1030       assert token_from_db
1031       token_from_db = Repo.preload(token_from_db, :user)
1032       assert token_from_db.user
1033
1034       assert token_from_db.user.confirmation_pending
1035     end
1036
1037     test "Account registration via app with account_approval_required", %{conn: conn} do
1038       Pleroma.Config.put([:instance, :account_approval_required], true)
1039
1040       conn =
1041         conn
1042         |> put_req_header("content-type", "application/json")
1043         |> post("/api/v1/apps", %{
1044           client_name: "client_name",
1045           redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
1046           scopes: "read, write, follow"
1047         })
1048
1049       assert %{
1050                "client_id" => client_id,
1051                "client_secret" => client_secret,
1052                "id" => _,
1053                "name" => "client_name",
1054                "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
1055                "vapid_key" => _,
1056                "website" => nil
1057              } = json_response_and_validate_schema(conn, 200)
1058
1059       conn =
1060         post(conn, "/oauth/token", %{
1061           grant_type: "client_credentials",
1062           client_id: client_id,
1063           client_secret: client_secret
1064         })
1065
1066       assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
1067                json_response(conn, 200)
1068
1069       assert token
1070       token_from_db = Repo.get_by(Token, token: token)
1071       assert token_from_db
1072       assert refresh
1073       assert scope == "read write follow"
1074
1075       conn =
1076         build_conn()
1077         |> put_req_header("content-type", "multipart/form-data")
1078         |> put_req_header("authorization", "Bearer " <> token)
1079         |> post("/api/v1/accounts", %{
1080           username: "lain",
1081           email: "lain@example.org",
1082           password: "PlzDontHackLain",
1083           bio: "Test Bio",
1084           agreement: true,
1085           reason: "I'm a cool dude, bro"
1086         })
1087
1088       %{
1089         "access_token" => token,
1090         "created_at" => _created_at,
1091         "scope" => ^scope,
1092         "token_type" => "Bearer"
1093       } = json_response_and_validate_schema(conn, 200)
1094
1095       token_from_db = Repo.get_by(Token, token: token)
1096       assert token_from_db
1097       token_from_db = Repo.preload(token_from_db, :user)
1098       assert token_from_db.user
1099
1100       assert token_from_db.user.approval_pending
1101
1102       assert token_from_db.user.registration_reason == "I'm a cool dude, bro"
1103     end
1104
1105     test "returns error when user already registred", %{conn: conn, valid_params: valid_params} do
1106       _user = insert(:user, email: "lain@example.org")
1107       app_token = insert(:oauth_token, user: nil)
1108
1109       res =
1110         conn
1111         |> put_req_header("authorization", "Bearer " <> app_token.token)
1112         |> put_req_header("content-type", "application/json")
1113         |> post("/api/v1/accounts", valid_params)
1114
1115       assert json_response_and_validate_schema(res, 400) == %{
1116                "error" => "{\"email\":[\"has already been taken\"]}"
1117              }
1118     end
1119
1120     test "returns bad_request if missing required params", %{
1121       conn: conn,
1122       valid_params: valid_params
1123     } do
1124       app_token = insert(:oauth_token, user: nil)
1125
1126       conn =
1127         conn
1128         |> put_req_header("authorization", "Bearer " <> app_token.token)
1129         |> put_req_header("content-type", "application/json")
1130
1131       res = post(conn, "/api/v1/accounts", valid_params)
1132       assert json_response_and_validate_schema(res, 200)
1133
1134       [{127, 0, 0, 1}, {127, 0, 0, 2}, {127, 0, 0, 3}, {127, 0, 0, 4}]
1135       |> Stream.zip(Map.delete(valid_params, :email))
1136       |> Enum.each(fn {ip, {attr, _}} ->
1137         res =
1138           conn
1139           |> Map.put(:remote_ip, ip)
1140           |> post("/api/v1/accounts", Map.delete(valid_params, attr))
1141           |> json_response_and_validate_schema(400)
1142
1143         assert res == %{
1144                  "error" => "Missing field: #{attr}.",
1145                  "errors" => [
1146                    %{
1147                      "message" => "Missing field: #{attr}",
1148                      "source" => %{"pointer" => "/#{attr}"},
1149                      "title" => "Invalid value"
1150                    }
1151                  ]
1152                }
1153       end)
1154     end
1155
1156     setup do: clear_config([:instance, :account_activation_required])
1157
1158     test "returns bad_request if missing email params when :account_activation_required is enabled",
1159          %{conn: conn, valid_params: valid_params} do
1160       Pleroma.Config.put([:instance, :account_activation_required], true)
1161
1162       app_token = insert(:oauth_token, user: nil)
1163
1164       conn =
1165         conn
1166         |> put_req_header("authorization", "Bearer " <> app_token.token)
1167         |> put_req_header("content-type", "application/json")
1168
1169       res =
1170         conn
1171         |> Map.put(:remote_ip, {127, 0, 0, 5})
1172         |> post("/api/v1/accounts", Map.delete(valid_params, :email))
1173
1174       assert json_response_and_validate_schema(res, 400) ==
1175                %{"error" => "Missing parameter: email"}
1176
1177       res =
1178         conn
1179         |> Map.put(:remote_ip, {127, 0, 0, 6})
1180         |> post("/api/v1/accounts", Map.put(valid_params, :email, ""))
1181
1182       assert json_response_and_validate_schema(res, 400) == %{
1183                "error" => "{\"email\":[\"can't be blank\"]}"
1184              }
1185     end
1186
1187     test "allow registration without an email", %{conn: conn, valid_params: valid_params} do
1188       app_token = insert(:oauth_token, user: nil)
1189       conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
1190
1191       res =
1192         conn
1193         |> put_req_header("content-type", "application/json")
1194         |> Map.put(:remote_ip, {127, 0, 0, 7})
1195         |> post("/api/v1/accounts", Map.delete(valid_params, :email))
1196
1197       assert json_response_and_validate_schema(res, 200)
1198     end
1199
1200     test "allow registration with an empty email", %{conn: conn, valid_params: valid_params} do
1201       app_token = insert(:oauth_token, user: nil)
1202       conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
1203
1204       res =
1205         conn
1206         |> put_req_header("content-type", "application/json")
1207         |> Map.put(:remote_ip, {127, 0, 0, 8})
1208         |> post("/api/v1/accounts", Map.put(valid_params, :email, ""))
1209
1210       assert json_response_and_validate_schema(res, 200)
1211     end
1212
1213     test "returns forbidden if token is invalid", %{conn: conn, valid_params: valid_params} do
1214       res =
1215         conn
1216         |> put_req_header("authorization", "Bearer " <> "invalid-token")
1217         |> put_req_header("content-type", "multipart/form-data")
1218         |> post("/api/v1/accounts", valid_params)
1219
1220       assert json_response_and_validate_schema(res, 403) == %{"error" => "Invalid credentials"}
1221     end
1222
1223     test "registration from trusted app" do
1224       clear_config([Pleroma.Captcha, :enabled], true)
1225       app = insert(:oauth_app, trusted: true, scopes: ["read", "write", "follow", "push"])
1226
1227       conn =
1228         build_conn()
1229         |> post("/oauth/token", %{
1230           "grant_type" => "client_credentials",
1231           "client_id" => app.client_id,
1232           "client_secret" => app.client_secret
1233         })
1234
1235       assert %{"access_token" => token, "token_type" => "Bearer"} = json_response(conn, 200)
1236
1237       response =
1238         build_conn()
1239         |> Plug.Conn.put_req_header("authorization", "Bearer " <> token)
1240         |> put_req_header("content-type", "multipart/form-data")
1241         |> post("/api/v1/accounts", %{
1242           nickname: "nickanme",
1243           agreement: true,
1244           email: "email@example.com",
1245           fullname: "Lain",
1246           username: "Lain",
1247           password: "some_password",
1248           confirm: "some_password"
1249         })
1250         |> json_response_and_validate_schema(200)
1251
1252       assert %{
1253                "access_token" => access_token,
1254                "created_at" => _,
1255                "scope" => "read write follow push",
1256                "token_type" => "Bearer"
1257              } = response
1258
1259       response =
1260         build_conn()
1261         |> Plug.Conn.put_req_header("authorization", "Bearer " <> access_token)
1262         |> get("/api/v1/accounts/verify_credentials")
1263         |> json_response_and_validate_schema(200)
1264
1265       assert %{
1266                "acct" => "Lain",
1267                "bot" => false,
1268                "display_name" => "Lain",
1269                "follow_requests_count" => 0,
1270                "followers_count" => 0,
1271                "following_count" => 0,
1272                "locked" => false,
1273                "note" => "",
1274                "source" => %{
1275                  "fields" => [],
1276                  "note" => "",
1277                  "pleroma" => %{
1278                    "actor_type" => "Person",
1279                    "discoverable" => false,
1280                    "no_rich_text" => false,
1281                    "show_role" => true
1282                  },
1283                  "privacy" => "public",
1284                  "sensitive" => false
1285                },
1286                "statuses_count" => 0,
1287                "username" => "Lain"
1288              } = response
1289     end
1290   end
1291
1292   describe "create account by app / rate limit" do
1293     setup do: clear_config([:rate_limit, :app_account_creation], {10_000, 2})
1294
1295     test "respects rate limit setting", %{conn: conn} do
1296       app_token = insert(:oauth_token, user: nil)
1297
1298       conn =
1299         conn
1300         |> put_req_header("authorization", "Bearer " <> app_token.token)
1301         |> Map.put(:remote_ip, {15, 15, 15, 15})
1302         |> put_req_header("content-type", "multipart/form-data")
1303
1304       for i <- 1..2 do
1305         conn =
1306           conn
1307           |> post("/api/v1/accounts", %{
1308             username: "#{i}lain",
1309             email: "#{i}lain@example.org",
1310             password: "PlzDontHackLain",
1311             agreement: true
1312           })
1313
1314         %{
1315           "access_token" => token,
1316           "created_at" => _created_at,
1317           "scope" => _scope,
1318           "token_type" => "Bearer"
1319         } = json_response_and_validate_schema(conn, 200)
1320
1321         token_from_db = Repo.get_by(Token, token: token)
1322         assert token_from_db
1323         token_from_db = Repo.preload(token_from_db, :user)
1324         assert token_from_db.user
1325       end
1326
1327       conn =
1328         post(conn, "/api/v1/accounts", %{
1329           username: "6lain",
1330           email: "6lain@example.org",
1331           password: "PlzDontHackLain",
1332           agreement: true
1333         })
1334
1335       assert json_response_and_validate_schema(conn, :too_many_requests) == %{
1336                "error" => "Throttled"
1337              }
1338     end
1339   end
1340
1341   describe "create account with enabled captcha" do
1342     setup %{conn: conn} do
1343       app_token = insert(:oauth_token, user: nil)
1344
1345       conn =
1346         conn
1347         |> put_req_header("authorization", "Bearer " <> app_token.token)
1348         |> put_req_header("content-type", "multipart/form-data")
1349
1350       [conn: conn]
1351     end
1352
1353     setup do: clear_config([Pleroma.Captcha, :enabled], true)
1354
1355     test "creates an account and returns 200 if captcha is valid", %{conn: conn} do
1356       %{token: token, answer_data: answer_data} = Pleroma.Captcha.new()
1357
1358       params = %{
1359         username: "lain",
1360         email: "lain@example.org",
1361         password: "PlzDontHackLain",
1362         agreement: true,
1363         captcha_solution: Pleroma.Captcha.Mock.solution(),
1364         captcha_token: token,
1365         captcha_answer_data: answer_data
1366       }
1367
1368       assert %{
1369                "access_token" => access_token,
1370                "created_at" => _,
1371                "scope" => "read",
1372                "token_type" => "Bearer"
1373              } =
1374                conn
1375                |> post("/api/v1/accounts", params)
1376                |> json_response_and_validate_schema(:ok)
1377
1378       assert Token |> Repo.get_by(token: access_token) |> Repo.preload(:user) |> Map.get(:user)
1379
1380       Cachex.del(:used_captcha_cache, token)
1381     end
1382
1383     test "returns 400 if any captcha field is not provided", %{conn: conn} do
1384       captcha_fields = [:captcha_solution, :captcha_token, :captcha_answer_data]
1385
1386       valid_params = %{
1387         username: "lain",
1388         email: "lain@example.org",
1389         password: "PlzDontHackLain",
1390         agreement: true,
1391         captcha_solution: "xx",
1392         captcha_token: "xx",
1393         captcha_answer_data: "xx"
1394       }
1395
1396       for field <- captcha_fields do
1397         expected = %{
1398           "error" => "{\"captcha\":[\"Invalid CAPTCHA (Missing parameter: #{field})\"]}"
1399         }
1400
1401         assert expected ==
1402                  conn
1403                  |> post("/api/v1/accounts", Map.delete(valid_params, field))
1404                  |> json_response_and_validate_schema(:bad_request)
1405       end
1406     end
1407
1408     test "returns an error if captcha is invalid", %{conn: conn} do
1409       params = %{
1410         username: "lain",
1411         email: "lain@example.org",
1412         password: "PlzDontHackLain",
1413         agreement: true,
1414         captcha_solution: "cofe",
1415         captcha_token: "cofe",
1416         captcha_answer_data: "cofe"
1417       }
1418
1419       assert %{"error" => "{\"captcha\":[\"Invalid answer data\"]}"} ==
1420                conn
1421                |> post("/api/v1/accounts", params)
1422                |> json_response_and_validate_schema(:bad_request)
1423     end
1424   end
1425
1426   describe "GET /api/v1/accounts/:id/lists - account_lists" do
1427     test "returns lists to which the account belongs" do
1428       %{user: user, conn: conn} = oauth_access(["read:lists"])
1429       other_user = insert(:user)
1430       assert {:ok, %Pleroma.List{id: list_id} = list} = Pleroma.List.create("Test List", user)
1431       {:ok, %{following: _following}} = Pleroma.List.follow(list, other_user)
1432
1433       assert [%{"id" => list_id, "title" => "Test List"}] =
1434                conn
1435                |> get("/api/v1/accounts/#{other_user.id}/lists")
1436                |> json_response_and_validate_schema(200)
1437     end
1438   end
1439
1440   describe "verify_credentials" do
1441     test "verify_credentials" do
1442       %{user: user, conn: conn} = oauth_access(["read:accounts"])
1443       [notification | _] = insert_list(7, :notification, user: user)
1444       Pleroma.Notification.set_read_up_to(user, notification.id)
1445       conn = get(conn, "/api/v1/accounts/verify_credentials")
1446
1447       response = json_response_and_validate_schema(conn, 200)
1448
1449       assert %{"id" => id, "source" => %{"privacy" => "public"}} = response
1450       assert response["pleroma"]["chat_token"]
1451       assert response["pleroma"]["unread_notifications_count"] == 6
1452       assert id == to_string(user.id)
1453     end
1454
1455     test "verify_credentials default scope unlisted" do
1456       user = insert(:user, default_scope: "unlisted")
1457       %{conn: conn} = oauth_access(["read:accounts"], user: user)
1458
1459       conn = get(conn, "/api/v1/accounts/verify_credentials")
1460
1461       assert %{"id" => id, "source" => %{"privacy" => "unlisted"}} =
1462                json_response_and_validate_schema(conn, 200)
1463
1464       assert id == to_string(user.id)
1465     end
1466
1467     test "locked accounts" do
1468       user = insert(:user, default_scope: "private")
1469       %{conn: conn} = oauth_access(["read:accounts"], user: user)
1470
1471       conn = get(conn, "/api/v1/accounts/verify_credentials")
1472
1473       assert %{"id" => id, "source" => %{"privacy" => "private"}} =
1474                json_response_and_validate_schema(conn, 200)
1475
1476       assert id == to_string(user.id)
1477     end
1478   end
1479
1480   describe "user relationships" do
1481     setup do: oauth_access(["read:follows"])
1482
1483     test "returns the relationships for the current user", %{user: user, conn: conn} do
1484       %{id: other_user_id} = other_user = insert(:user)
1485       {:ok, _user} = User.follow(user, other_user)
1486
1487       assert [%{"id" => ^other_user_id}] =
1488                conn
1489                |> get("/api/v1/accounts/relationships?id=#{other_user.id}")
1490                |> json_response_and_validate_schema(200)
1491
1492       assert [%{"id" => ^other_user_id}] =
1493                conn
1494                |> get("/api/v1/accounts/relationships?id[]=#{other_user.id}")
1495                |> json_response_and_validate_schema(200)
1496     end
1497
1498     test "returns an empty list on a bad request", %{conn: conn} do
1499       conn = get(conn, "/api/v1/accounts/relationships", %{})
1500
1501       assert [] = json_response_and_validate_schema(conn, 200)
1502     end
1503   end
1504
1505   test "getting a list of mutes" do
1506     %{user: user, conn: conn} = oauth_access(["read:mutes"])
1507     other_user = insert(:user)
1508
1509     {:ok, _user_relationships} = User.mute(user, other_user)
1510
1511     conn = get(conn, "/api/v1/mutes")
1512
1513     other_user_id = to_string(other_user.id)
1514     assert [%{"id" => ^other_user_id}] = json_response_and_validate_schema(conn, 200)
1515   end
1516
1517   test "getting a list of blocks" do
1518     %{user: user, conn: conn} = oauth_access(["read:blocks"])
1519     other_user = insert(:user)
1520
1521     {:ok, _user_relationship} = User.block(user, other_user)
1522
1523     conn =
1524       conn
1525       |> assign(:user, user)
1526       |> get("/api/v1/blocks")
1527
1528     other_user_id = to_string(other_user.id)
1529     assert [%{"id" => ^other_user_id}] = json_response_and_validate_schema(conn, 200)
1530   end
1531 end