git.squeep.com Git - akkoma/blob - test/web/mastodon_api/controllers/timeline_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.TimelineControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   import Pleroma.Factory
   9   import Tesla.Mock
  10
  11   alias Pleroma.Config
  12   alias Pleroma.User
  13   alias Pleroma.Web.CommonAPI
  14
  15   setup do
  16     mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
  17     :ok
  18   end
  19
  20   describe "home" do
  21     setup do: oauth_access(["read:statuses"])
  22
  23     test "does NOT embed account/pleroma/relationship in statuses", %{
  24       user: user,
  25       conn: conn
  26     } do
  27       other_user = insert(:user)
  28
  29       {:ok, _} = CommonAPI.post(other_user, %{"status" => "hi @#{user.nickname}"})
  30
  31       response =
  32         conn
  33         |> assign(:user, user)
  34         |> get("/api/v1/timelines/home")
  35         |> json_response(200)
  36
  37       assert Enum.all?(response, fn n ->
  38                get_in(n, ["account", "pleroma", "relationship"]) == %{}
  39              end)
  40     end
  41
  42     test "the home timeline when the direct messages are excluded", %{user: user, conn: conn} do
  43       {:ok, public_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "public"})
  44       {:ok, direct_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "direct"})
  45
  46       {:ok, unlisted_activity} =
  47         CommonAPI.post(user, %{"status" => ".", "visibility" => "unlisted"})
  48
  49       {:ok, private_activity} =
  50         CommonAPI.post(user, %{"status" => ".", "visibility" => "private"})
  51
  52       conn = get(conn, "/api/v1/timelines/home", %{"exclude_visibilities" => ["direct"]})
  53
  54       assert status_ids = json_response(conn, :ok) |> Enum.map(& &1["id"])
  55       assert public_activity.id in status_ids
  56       assert unlisted_activity.id in status_ids
  57       assert private_activity.id in status_ids
  58       refute direct_activity.id in status_ids
  59     end
  60   end
  61
  62   describe "public" do
  63     @tag capture_log: true
  64     test "the public timeline", %{conn: conn} do
  65       following = insert(:user)
  66
  67       {:ok, _activity} = CommonAPI.post(following, %{"status" => "test"})
  68
  69       _activity = insert(:note_activity, local: false)
  70
  71       conn = get(conn, "/api/v1/timelines/public", %{"local" => "False"})
  72
  73       assert length(json_response(conn, :ok)) == 2
  74
  75       conn = get(build_conn(), "/api/v1/timelines/public", %{"local" => "True"})
  76
  77       assert [%{"content" => "test"}] = json_response(conn, :ok)
  78
  79       conn = get(build_conn(), "/api/v1/timelines/public", %{"local" => "1"})
  80
  81       assert [%{"content" => "test"}] = json_response(conn, :ok)
  82     end
  83
  84     test "the public timeline includes only public statuses for an authenticated user" do
  85       %{user: user, conn: conn} = oauth_access(["read:statuses"])
  86
  87       {:ok, _activity} = CommonAPI.post(user, %{"status" => "test"})
  88       {:ok, _activity} = CommonAPI.post(user, %{"status" => "test", "visibility" => "private"})
  89       {:ok, _activity} = CommonAPI.post(user, %{"status" => "test", "visibility" => "unlisted"})
  90       {:ok, _activity} = CommonAPI.post(user, %{"status" => "test", "visibility" => "direct"})
  91
  92       res_conn = get(conn, "/api/v1/timelines/public")
  93       assert length(json_response(res_conn, 200)) == 1
  94     end
  95   end
  96
  97   defp local_and_remote_activities do
  98     insert(:note_activity)
  99     insert(:note_activity, local: false)
 100     :ok
 101   end
 102
 103   describe "public with restrict unauthenticated timeline for local and federated timelines" do
 104     setup do: local_and_remote_activities()
 105
 106     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 107
 108     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 109
 110     test "if user is unauthenticated", %{conn: conn} do
 111       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 112
 113       assert json_response(res_conn, :unauthorized) == %{
 114                "error" => "authorization required for timeline view"
 115              }
 116
 117       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 118
 119       assert json_response(res_conn, :unauthorized) == %{
 120                "error" => "authorization required for timeline view"
 121              }
 122     end
 123
 124     test "if user is authenticated" do
 125       %{conn: conn} = oauth_access(["read:statuses"])
 126
 127       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 128       assert length(json_response(res_conn, 200)) == 1
 129
 130       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 131       assert length(json_response(res_conn, 200)) == 2
 132     end
 133   end
 134
 135   describe "public with restrict unauthenticated timeline for local" do
 136     setup do: local_and_remote_activities()
 137
 138     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 139
 140     test "if user is unauthenticated", %{conn: conn} do
 141       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 142
 143       assert json_response(res_conn, :unauthorized) == %{
 144                "error" => "authorization required for timeline view"
 145              }
 146
 147       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 148       assert length(json_response(res_conn, 200)) == 2
 149     end
 150
 151     test "if user is authenticated", %{conn: _conn} do
 152       %{conn: conn} = oauth_access(["read:statuses"])
 153
 154       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 155       assert length(json_response(res_conn, 200)) == 1
 156
 157       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 158       assert length(json_response(res_conn, 200)) == 2
 159     end
 160   end
 161
 162   describe "public with restrict unauthenticated timeline for remote" do
 163     setup do: local_and_remote_activities()
 164
 165     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 166
 167     test "if user is unauthenticated", %{conn: conn} do
 168       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 169       assert length(json_response(res_conn, 200)) == 1
 170
 171       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 172
 173       assert json_response(res_conn, :unauthorized) == %{
 174                "error" => "authorization required for timeline view"
 175              }
 176     end
 177
 178     test "if user is authenticated", %{conn: _conn} do
 179       %{conn: conn} = oauth_access(["read:statuses"])
 180
 181       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 182       assert length(json_response(res_conn, 200)) == 1
 183
 184       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 185       assert length(json_response(res_conn, 200)) == 2
 186     end
 187   end
 188
 189   describe "direct" do
 190     test "direct timeline", %{conn: conn} do
 191       user_one = insert(:user)
 192       user_two = insert(:user)
 193
 194       {:ok, user_two} = User.follow(user_two, user_one)
 195
 196       {:ok, direct} =
 197         CommonAPI.post(user_one, %{
 198           "status" => "Hi @#{user_two.nickname}!",
 199           "visibility" => "direct"
 200         })
 201
 202       {:ok, _follower_only} =
 203         CommonAPI.post(user_one, %{
 204           "status" => "Hi @#{user_two.nickname}!",
 205           "visibility" => "private"
 206         })
 207
 208       conn_user_two =
 209         conn
 210         |> assign(:user, user_two)
 211         |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
 212
 213       # Only direct should be visible here
 214       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 215
 216       [status] = json_response(res_conn, :ok)
 217
 218       assert %{"visibility" => "direct"} = status
 219       assert status["url"] != direct.data["id"]
 220
 221       # User should be able to see their own direct message
 222       res_conn =
 223         build_conn()
 224         |> assign(:user, user_one)
 225         |> assign(:token, insert(:oauth_token, user: user_one, scopes: ["read:statuses"]))
 226         |> get("api/v1/timelines/direct")
 227
 228       [status] = json_response(res_conn, :ok)
 229
 230       assert %{"visibility" => "direct"} = status
 231
 232       # Both should be visible here
 233       res_conn = get(conn_user_two, "api/v1/timelines/home")
 234
 235       [_s1, _s2] = json_response(res_conn, :ok)
 236
 237       # Test pagination
 238       Enum.each(1..20, fn _ ->
 239         {:ok, _} =
 240           CommonAPI.post(user_one, %{
 241             "status" => "Hi @#{user_two.nickname}!",
 242             "visibility" => "direct"
 243           })
 244       end)
 245
 246       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 247
 248       statuses = json_response(res_conn, :ok)
 249       assert length(statuses) == 20
 250
 251       res_conn =
 252         get(conn_user_two, "api/v1/timelines/direct", %{max_id: List.last(statuses)["id"]})
 253
 254       [status] = json_response(res_conn, :ok)
 255
 256       assert status["url"] != direct.data["id"]
 257     end
 258
 259     test "doesn't include DMs from blocked users" do
 260       %{user: blocker, conn: conn} = oauth_access(["read:statuses"])
 261       blocked = insert(:user)
 262       other_user = insert(:user)
 263       {:ok, _user_relationship} = User.block(blocker, blocked)
 264
 265       {:ok, _blocked_direct} =
 266         CommonAPI.post(blocked, %{
 267           "status" => "Hi @#{blocker.nickname}!",
 268           "visibility" => "direct"
 269         })
 270
 271       {:ok, direct} =
 272         CommonAPI.post(other_user, %{
 273           "status" => "Hi @#{blocker.nickname}!",
 274           "visibility" => "direct"
 275         })
 276
 277       res_conn = get(conn, "api/v1/timelines/direct")
 278
 279       [status] = json_response(res_conn, :ok)
 280       assert status["id"] == direct.id
 281     end
 282   end
 283
 284   describe "list" do
 285     setup do: oauth_access(["read:lists"])
 286
 287     test "list timeline", %{user: user, conn: conn} do
 288       other_user = insert(:user)
 289       {:ok, _activity_one} = CommonAPI.post(user, %{"status" => "Marisa is cute."})
 290       {:ok, activity_two} = CommonAPI.post(other_user, %{"status" => "Marisa is cute."})
 291       {:ok, list} = Pleroma.List.create("name", user)
 292       {:ok, list} = Pleroma.List.follow(list, other_user)
 293
 294       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 295
 296       assert [%{"id" => id}] = json_response(conn, :ok)
 297
 298       assert id == to_string(activity_two.id)
 299     end
 300
 301     test "list timeline does not leak non-public statuses for unfollowed users", %{
 302       user: user,
 303       conn: conn
 304     } do
 305       other_user = insert(:user)
 306       {:ok, activity_one} = CommonAPI.post(other_user, %{"status" => "Marisa is cute."})
 307
 308       {:ok, _activity_two} =
 309         CommonAPI.post(other_user, %{
 310           "status" => "Marisa is cute.",
 311           "visibility" => "private"
 312         })
 313
 314       {:ok, list} = Pleroma.List.create("name", user)
 315       {:ok, list} = Pleroma.List.follow(list, other_user)
 316
 317       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 318
 319       assert [%{"id" => id}] = json_response(conn, :ok)
 320
 321       assert id == to_string(activity_one.id)
 322     end
 323   end
 324
 325   describe "hashtag" do
 326     setup do: oauth_access(["n/a"])
 327
 328     @tag capture_log: true
 329     test "hashtag timeline", %{conn: conn} do
 330       following = insert(:user)
 331
 332       {:ok, activity} = CommonAPI.post(following, %{"status" => "test #2hu"})
 333
 334       nconn = get(conn, "/api/v1/timelines/tag/2hu")
 335
 336       assert [%{"id" => id}] = json_response(nconn, :ok)
 337
 338       assert id == to_string(activity.id)
 339
 340       # works for different capitalization too
 341       nconn = get(conn, "/api/v1/timelines/tag/2HU")
 342
 343       assert [%{"id" => id}] = json_response(nconn, :ok)
 344
 345       assert id == to_string(activity.id)
 346     end
 347
 348     test "multi-hashtag timeline", %{conn: conn} do
 349       user = insert(:user)
 350
 351       {:ok, activity_test} = CommonAPI.post(user, %{"status" => "#test"})
 352       {:ok, activity_test1} = CommonAPI.post(user, %{"status" => "#test #test1"})
 353       {:ok, activity_none} = CommonAPI.post(user, %{"status" => "#test #none"})
 354
 355       any_test = get(conn, "/api/v1/timelines/tag/test", %{"any" => ["test1"]})
 356
 357       [status_none, status_test1, status_test] = json_response(any_test, :ok)
 358
 359       assert to_string(activity_test.id) == status_test["id"]
 360       assert to_string(activity_test1.id) == status_test1["id"]
 361       assert to_string(activity_none.id) == status_none["id"]
 362
 363       restricted_test =
 364         get(conn, "/api/v1/timelines/tag/test", %{"all" => ["test1"], "none" => ["none"]})
 365
 366       assert [status_test1] == json_response(restricted_test, :ok)
 367
 368       all_test = get(conn, "/api/v1/timelines/tag/test", %{"all" => ["none"]})
 369
 370       assert [status_none] == json_response(all_test, :ok)
 371     end
 372   end
 373 end