1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Web.MastodonAPI.TimelineControllerTest do
6 use Pleroma.Web.ConnCase
13 alias Pleroma.Web.CommonAPI
16 mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
21 setup do: oauth_access(["read:statuses"])
23 test "does NOT embed account/pleroma/relationship in statuses", %{
27 other_user = insert(:user)
29 {:ok, _} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})
33 |> assign(:user, user)
34 |> get("/api/v1/timelines/home")
35 |> json_response_and_validate_schema(200)
37 assert Enum.all?(response, fn n ->
38 get_in(n, ["account", "pleroma", "relationship"]) == %{}
42 test "the home timeline when the direct messages are excluded", %{user: user, conn: conn} do
43 {:ok, public_activity} = CommonAPI.post(user, %{status: ".", visibility: "public"})
44 {:ok, direct_activity} = CommonAPI.post(user, %{status: ".", visibility: "direct"})
46 {:ok, unlisted_activity} = CommonAPI.post(user, %{status: ".", visibility: "unlisted"})
48 {:ok, private_activity} = CommonAPI.post(user, %{status: ".", visibility: "private"})
50 conn = get(conn, "/api/v1/timelines/home?exclude_visibilities[]=direct")
52 assert status_ids = json_response_and_validate_schema(conn, :ok) |> Enum.map(& &1["id"])
53 assert public_activity.id in status_ids
54 assert unlisted_activity.id in status_ids
55 assert private_activity.id in status_ids
56 refute direct_activity.id in status_ids
61 @tag capture_log: true
62 test "the public timeline", %{conn: conn} do
63 following = insert(:user)
65 {:ok, _activity} = CommonAPI.post(following, %{status: "test"})
67 _activity = insert(:note_activity, local: false)
69 conn = get(conn, "/api/v1/timelines/public?local=False")
71 assert length(json_response_and_validate_schema(conn, :ok)) == 2
73 conn = get(build_conn(), "/api/v1/timelines/public?local=True")
75 assert [%{"content" => "test"}] = json_response_and_validate_schema(conn, :ok)
77 conn = get(build_conn(), "/api/v1/timelines/public?local=1")
79 assert [%{"content" => "test"}] = json_response_and_validate_schema(conn, :ok)
82 test "the public timeline includes only public statuses for an authenticated user" do
83 %{user: user, conn: conn} = oauth_access(["read:statuses"])
85 {:ok, _activity} = CommonAPI.post(user, %{status: "test"})
86 {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "private"})
87 {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "unlisted"})
88 {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "direct"})
90 res_conn = get(conn, "/api/v1/timelines/public")
91 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
95 defp local_and_remote_activities do
96 insert(:note_activity)
97 insert(:note_activity, local: false)
101 describe "public with restrict unauthenticated timeline for local and federated timelines" do
102 setup do: local_and_remote_activities()
104 setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
106 setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
108 test "if user is unauthenticated", %{conn: conn} do
109 res_conn = get(conn, "/api/v1/timelines/public?local=true")
111 assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
112 "error" => "authorization required for timeline view"
115 res_conn = get(conn, "/api/v1/timelines/public?local=false")
117 assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
118 "error" => "authorization required for timeline view"
122 test "if user is authenticated" do
123 %{conn: conn} = oauth_access(["read:statuses"])
125 res_conn = get(conn, "/api/v1/timelines/public?local=true")
126 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
128 res_conn = get(conn, "/api/v1/timelines/public?local=false")
129 assert length(json_response_and_validate_schema(res_conn, 200)) == 2
133 describe "public with restrict unauthenticated timeline for local" do
134 setup do: local_and_remote_activities()
136 setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
138 test "if user is unauthenticated", %{conn: conn} do
139 res_conn = get(conn, "/api/v1/timelines/public?local=true")
141 assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
142 "error" => "authorization required for timeline view"
145 res_conn = get(conn, "/api/v1/timelines/public?local=false")
146 assert length(json_response_and_validate_schema(res_conn, 200)) == 2
149 test "if user is authenticated", %{conn: _conn} do
150 %{conn: conn} = oauth_access(["read:statuses"])
152 res_conn = get(conn, "/api/v1/timelines/public?local=true")
153 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
155 res_conn = get(conn, "/api/v1/timelines/public?local=false")
156 assert length(json_response_and_validate_schema(res_conn, 200)) == 2
160 describe "public with restrict unauthenticated timeline for remote" do
161 setup do: local_and_remote_activities()
163 setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
165 test "if user is unauthenticated", %{conn: conn} do
166 res_conn = get(conn, "/api/v1/timelines/public?local=true")
167 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
169 res_conn = get(conn, "/api/v1/timelines/public?local=false")
171 assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
172 "error" => "authorization required for timeline view"
176 test "if user is authenticated", %{conn: _conn} do
177 %{conn: conn} = oauth_access(["read:statuses"])
179 res_conn = get(conn, "/api/v1/timelines/public?local=true")
180 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
182 res_conn = get(conn, "/api/v1/timelines/public?local=false")
183 assert length(json_response_and_validate_schema(res_conn, 200)) == 2
188 test "direct timeline", %{conn: conn} do
189 user_one = insert(:user)
190 user_two = insert(:user)
192 {:ok, user_two} = User.follow(user_two, user_one)
195 CommonAPI.post(user_one, %{
196 status: "Hi @#{user_two.nickname}!",
200 {:ok, _follower_only} =
201 CommonAPI.post(user_one, %{
202 status: "Hi @#{user_two.nickname}!",
203 visibility: "private"
208 |> assign(:user, user_two)
209 |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
211 # Only direct should be visible here
212 res_conn = get(conn_user_two, "api/v1/timelines/direct")
214 assert [status] = json_response_and_validate_schema(res_conn, :ok)
216 assert %{"visibility" => "direct"} = status
217 assert status["url"] != direct.data["id"]
219 # User should be able to see their own direct message
222 |> assign(:user, user_one)
223 |> assign(:token, insert(:oauth_token, user: user_one, scopes: ["read:statuses"]))
224 |> get("api/v1/timelines/direct")
226 [status] = json_response_and_validate_schema(res_conn, :ok)
228 assert %{"visibility" => "direct"} = status
230 # Both should be visible here
231 res_conn = get(conn_user_two, "api/v1/timelines/home")
233 [_s1, _s2] = json_response_and_validate_schema(res_conn, :ok)
236 Enum.each(1..20, fn _ ->
238 CommonAPI.post(user_one, %{
239 status: "Hi @#{user_two.nickname}!",
244 res_conn = get(conn_user_two, "api/v1/timelines/direct")
246 statuses = json_response_and_validate_schema(res_conn, :ok)
247 assert length(statuses) == 20
249 max_id = List.last(statuses)["id"]
251 res_conn = get(conn_user_two, "api/v1/timelines/direct?max_id=#{max_id}")
253 assert [status] = json_response_and_validate_schema(res_conn, :ok)
255 assert status["url"] != direct.data["id"]
258 test "doesn't include DMs from blocked users" do
259 %{user: blocker, conn: conn} = oauth_access(["read:statuses"])
260 blocked = insert(:user)
261 other_user = insert(:user)
262 {:ok, _user_relationship} = User.block(blocker, blocked)
264 {:ok, _blocked_direct} =
265 CommonAPI.post(blocked, %{
266 status: "Hi @#{blocker.nickname}!",
271 CommonAPI.post(other_user, %{
272 status: "Hi @#{blocker.nickname}!",
276 res_conn = get(conn, "api/v1/timelines/direct")
278 [status] = json_response_and_validate_schema(res_conn, :ok)
279 assert status["id"] == direct.id
284 setup do: oauth_access(["read:lists"])
286 test "list timeline", %{user: user, conn: conn} do
287 other_user = insert(:user)
288 {:ok, _activity_one} = CommonAPI.post(user, %{status: "Marisa is cute."})
289 {:ok, activity_two} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
290 {:ok, list} = Pleroma.List.create("name", user)
291 {:ok, list} = Pleroma.List.follow(list, other_user)
293 conn = get(conn, "/api/v1/timelines/list/#{list.id}")
295 assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
297 assert id == to_string(activity_two.id)
300 test "list timeline does not leak non-public statuses for unfollowed users", %{
304 other_user = insert(:user)
305 {:ok, activity_one} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
307 {:ok, _activity_two} =
308 CommonAPI.post(other_user, %{
309 status: "Marisa is cute.",
310 visibility: "private"
313 {:ok, list} = Pleroma.List.create("name", user)
314 {:ok, list} = Pleroma.List.follow(list, other_user)
316 conn = get(conn, "/api/v1/timelines/list/#{list.id}")
318 assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
320 assert id == to_string(activity_one.id)
324 describe "hashtag" do
325 setup do: oauth_access(["n/a"])
327 @tag capture_log: true
328 test "hashtag timeline", %{conn: conn} do
329 following = insert(:user)
331 {:ok, activity} = CommonAPI.post(following, %{status: "test #2hu"})
333 nconn = get(conn, "/api/v1/timelines/tag/2hu")
335 assert [%{"id" => id}] = json_response_and_validate_schema(nconn, :ok)
337 assert id == to_string(activity.id)
339 # works for different capitalization too
340 nconn = get(conn, "/api/v1/timelines/tag/2HU")
342 assert [%{"id" => id}] = json_response_and_validate_schema(nconn, :ok)
344 assert id == to_string(activity.id)
347 test "multi-hashtag timeline", %{conn: conn} do
350 {:ok, activity_test} = CommonAPI.post(user, %{status: "#test"})
351 {:ok, activity_test1} = CommonAPI.post(user, %{status: "#test #test1"})
352 {:ok, activity_none} = CommonAPI.post(user, %{status: "#test #none"})
354 any_test = get(conn, "/api/v1/timelines/tag/test?any[]=test1")
356 [status_none, status_test1, status_test] = json_response_and_validate_schema(any_test, :ok)
358 assert to_string(activity_test.id) == status_test["id"]
359 assert to_string(activity_test1.id) == status_test1["id"]
360 assert to_string(activity_none.id) == status_none["id"]
362 restricted_test = get(conn, "/api/v1/timelines/tag/test?all[]=test1&none[]=none")
364 assert [status_test1] == json_response_and_validate_schema(restricted_test, :ok)
366 all_test = get(conn, "/api/v1/timelines/tag/test?all[]=none")
368 assert [status_none] == json_response_and_validate_schema(all_test, :ok)