git.squeep.com Git - akkoma/blob - test/web/mastodon_api/controllers/timeline_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.TimelineControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   import Pleroma.Factory
   9   import Tesla.Mock
  10
  11   alias Pleroma.Config
  12   alias Pleroma.User
  13   alias Pleroma.Web.CommonAPI
  14
  15   setup do
  16     mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
  17     :ok
  18   end
  19
  20   describe "home" do
  21     setup do: oauth_access(["read:statuses"])
  22
  23     test "the home timeline", %{user: user, conn: conn} do
  24       following = insert(:user)
  25
  26       {:ok, _activity} = CommonAPI.post(following, %{"status" => "test"})
  27
  28       ret_conn = get(conn, "/api/v1/timelines/home")
  29
  30       assert Enum.empty?(json_response(ret_conn, :ok))
  31
  32       {:ok, _user} = User.follow(user, following)
  33
  34       conn = get(conn, "/api/v1/timelines/home")
  35
  36       assert [%{"content" => "test"}] = json_response(conn, :ok)
  37     end
  38
  39     test "the home timeline when the direct messages are excluded", %{user: user, conn: conn} do
  40       {:ok, public_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "public"})
  41       {:ok, direct_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "direct"})
  42
  43       {:ok, unlisted_activity} =
  44         CommonAPI.post(user, %{"status" => ".", "visibility" => "unlisted"})
  45
  46       {:ok, private_activity} =
  47         CommonAPI.post(user, %{"status" => ".", "visibility" => "private"})
  48
  49       conn = get(conn, "/api/v1/timelines/home", %{"exclude_visibilities" => ["direct"]})
  50
  51       assert status_ids = json_response(conn, :ok) |> Enum.map(& &1["id"])
  52       assert public_activity.id in status_ids
  53       assert unlisted_activity.id in status_ids
  54       assert private_activity.id in status_ids
  55       refute direct_activity.id in status_ids
  56     end
  57   end
  58
  59   describe "public" do
  60     @tag capture_log: true
  61     test "the public timeline", %{conn: conn} do
  62       following = insert(:user)
  63
  64       {:ok, _activity} = CommonAPI.post(following, %{"status" => "test"})
  65
  66       _activity = insert(:note_activity, local: false)
  67
  68       conn = get(conn, "/api/v1/timelines/public", %{"local" => "False"})
  69
  70       assert length(json_response(conn, :ok)) == 2
  71
  72       conn = get(build_conn(), "/api/v1/timelines/public", %{"local" => "True"})
  73
  74       assert [%{"content" => "test"}] = json_response(conn, :ok)
  75
  76       conn = get(build_conn(), "/api/v1/timelines/public", %{"local" => "1"})
  77
  78       assert [%{"content" => "test"}] = json_response(conn, :ok)
  79     end
  80
  81     test "the public timeline includes only public statuses for an authenticated user" do
  82       %{user: user, conn: conn} = oauth_access(["read:statuses"])
  83
  84       {:ok, _activity} = CommonAPI.post(user, %{"status" => "test"})
  85       {:ok, _activity} = CommonAPI.post(user, %{"status" => "test", "visibility" => "private"})
  86       {:ok, _activity} = CommonAPI.post(user, %{"status" => "test", "visibility" => "unlisted"})
  87       {:ok, _activity} = CommonAPI.post(user, %{"status" => "test", "visibility" => "direct"})
  88
  89       res_conn = get(conn, "/api/v1/timelines/public")
  90       assert length(json_response(res_conn, 200)) == 1
  91     end
  92   end
  93
  94   defp local_and_remote_activities do
  95     insert(:note_activity)
  96     insert(:note_activity, local: false)
  97     :ok
  98   end
  99
 100   describe "public with restrict unauthenticated timeline for local and federated timelines" do
 101     setup do: local_and_remote_activities()
 102
 103     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 104
 105     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 106
 107     test "if user is unauthenticated", %{conn: conn} do
 108       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 109
 110       assert json_response(res_conn, :unauthorized) == %{
 111                "error" => "authorization required for timeline view"
 112              }
 113
 114       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 115
 116       assert json_response(res_conn, :unauthorized) == %{
 117                "error" => "authorization required for timeline view"
 118              }
 119     end
 120
 121     test "if user is authenticated" do
 122       %{conn: conn} = oauth_access(["read:statuses"])
 123
 124       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 125       assert length(json_response(res_conn, 200)) == 1
 126
 127       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 128       assert length(json_response(res_conn, 200)) == 2
 129     end
 130   end
 131
 132   describe "public with restrict unauthenticated timeline for local" do
 133     setup do: local_and_remote_activities()
 134
 135     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 136
 137     test "if user is unauthenticated", %{conn: conn} do
 138       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 139
 140       assert json_response(res_conn, :unauthorized) == %{
 141                "error" => "authorization required for timeline view"
 142              }
 143
 144       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 145       assert length(json_response(res_conn, 200)) == 2
 146     end
 147
 148     test "if user is authenticated", %{conn: _conn} do
 149       %{conn: conn} = oauth_access(["read:statuses"])
 150
 151       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 152       assert length(json_response(res_conn, 200)) == 1
 153
 154       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 155       assert length(json_response(res_conn, 200)) == 2
 156     end
 157   end
 158
 159   describe "public with restrict unauthenticated timeline for remote" do
 160     setup do: local_and_remote_activities()
 161
 162     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 163
 164     test "if user is unauthenticated", %{conn: conn} do
 165       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 166       assert length(json_response(res_conn, 200)) == 1
 167
 168       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 169
 170       assert json_response(res_conn, :unauthorized) == %{
 171                "error" => "authorization required for timeline view"
 172              }
 173     end
 174
 175     test "if user is authenticated", %{conn: _conn} do
 176       %{conn: conn} = oauth_access(["read:statuses"])
 177
 178       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 179       assert length(json_response(res_conn, 200)) == 1
 180
 181       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 182       assert length(json_response(res_conn, 200)) == 2
 183     end
 184   end
 185
 186   describe "direct" do
 187     test "direct timeline", %{conn: conn} do
 188       user_one = insert(:user)
 189       user_two = insert(:user)
 190
 191       {:ok, user_two} = User.follow(user_two, user_one)
 192
 193       {:ok, direct} =
 194         CommonAPI.post(user_one, %{
 195           "status" => "Hi @#{user_two.nickname}!",
 196           "visibility" => "direct"
 197         })
 198
 199       {:ok, _follower_only} =
 200         CommonAPI.post(user_one, %{
 201           "status" => "Hi @#{user_two.nickname}!",
 202           "visibility" => "private"
 203         })
 204
 205       conn_user_two =
 206         conn
 207         |> assign(:user, user_two)
 208         |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
 209
 210       # Only direct should be visible here
 211       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 212
 213       [status] = json_response(res_conn, :ok)
 214
 215       assert %{"visibility" => "direct"} = status
 216       assert status["url"] != direct.data["id"]
 217
 218       # User should be able to see their own direct message
 219       res_conn =
 220         build_conn()
 221         |> assign(:user, user_one)
 222         |> assign(:token, insert(:oauth_token, user: user_one, scopes: ["read:statuses"]))
 223         |> get("api/v1/timelines/direct")
 224
 225       [status] = json_response(res_conn, :ok)
 226
 227       assert %{"visibility" => "direct"} = status
 228
 229       # Both should be visible here
 230       res_conn = get(conn_user_two, "api/v1/timelines/home")
 231
 232       [_s1, _s2] = json_response(res_conn, :ok)
 233
 234       # Test pagination
 235       Enum.each(1..20, fn _ ->
 236         {:ok, _} =
 237           CommonAPI.post(user_one, %{
 238             "status" => "Hi @#{user_two.nickname}!",
 239             "visibility" => "direct"
 240           })
 241       end)
 242
 243       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 244
 245       statuses = json_response(res_conn, :ok)
 246       assert length(statuses) == 20
 247
 248       res_conn =
 249         get(conn_user_two, "api/v1/timelines/direct", %{max_id: List.last(statuses)["id"]})
 250
 251       [status] = json_response(res_conn, :ok)
 252
 253       assert status["url"] != direct.data["id"]
 254     end
 255
 256     test "doesn't include DMs from blocked users" do
 257       %{user: blocker, conn: conn} = oauth_access(["read:statuses"])
 258       blocked = insert(:user)
 259       other_user = insert(:user)
 260       {:ok, _user_relationship} = User.block(blocker, blocked)
 261
 262       {:ok, _blocked_direct} =
 263         CommonAPI.post(blocked, %{
 264           "status" => "Hi @#{blocker.nickname}!",
 265           "visibility" => "direct"
 266         })
 267
 268       {:ok, direct} =
 269         CommonAPI.post(other_user, %{
 270           "status" => "Hi @#{blocker.nickname}!",
 271           "visibility" => "direct"
 272         })
 273
 274       res_conn = get(conn, "api/v1/timelines/direct")
 275
 276       [status] = json_response(res_conn, :ok)
 277       assert status["id"] == direct.id
 278     end
 279   end
 280
 281   describe "list" do
 282     setup do: oauth_access(["read:lists"])
 283
 284     test "list timeline", %{user: user, conn: conn} do
 285       other_user = insert(:user)
 286       {:ok, _activity_one} = CommonAPI.post(user, %{"status" => "Marisa is cute."})
 287       {:ok, activity_two} = CommonAPI.post(other_user, %{"status" => "Marisa is cute."})
 288       {:ok, list} = Pleroma.List.create("name", user)
 289       {:ok, list} = Pleroma.List.follow(list, other_user)
 290
 291       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 292
 293       assert [%{"id" => id}] = json_response(conn, :ok)
 294
 295       assert id == to_string(activity_two.id)
 296     end
 297
 298     test "list timeline does not leak non-public statuses for unfollowed users", %{
 299       user: user,
 300       conn: conn
 301     } do
 302       other_user = insert(:user)
 303       {:ok, activity_one} = CommonAPI.post(other_user, %{"status" => "Marisa is cute."})
 304
 305       {:ok, _activity_two} =
 306         CommonAPI.post(other_user, %{
 307           "status" => "Marisa is cute.",
 308           "visibility" => "private"
 309         })
 310
 311       {:ok, list} = Pleroma.List.create("name", user)
 312       {:ok, list} = Pleroma.List.follow(list, other_user)
 313
 314       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 315
 316       assert [%{"id" => id}] = json_response(conn, :ok)
 317
 318       assert id == to_string(activity_one.id)
 319     end
 320   end
 321
 322   describe "hashtag" do
 323     setup do: oauth_access(["n/a"])
 324
 325     @tag capture_log: true
 326     test "hashtag timeline", %{conn: conn} do
 327       following = insert(:user)
 328
 329       {:ok, activity} = CommonAPI.post(following, %{"status" => "test #2hu"})
 330
 331       nconn = get(conn, "/api/v1/timelines/tag/2hu")
 332
 333       assert [%{"id" => id}] = json_response(nconn, :ok)
 334
 335       assert id == to_string(activity.id)
 336
 337       # works for different capitalization too
 338       nconn = get(conn, "/api/v1/timelines/tag/2HU")
 339
 340       assert [%{"id" => id}] = json_response(nconn, :ok)
 341
 342       assert id == to_string(activity.id)
 343     end
 344
 345     test "multi-hashtag timeline", %{conn: conn} do
 346       user = insert(:user)
 347
 348       {:ok, activity_test} = CommonAPI.post(user, %{"status" => "#test"})
 349       {:ok, activity_test1} = CommonAPI.post(user, %{"status" => "#test #test1"})
 350       {:ok, activity_none} = CommonAPI.post(user, %{"status" => "#test #none"})
 351
 352       any_test = get(conn, "/api/v1/timelines/tag/test", %{"any" => ["test1"]})
 353
 354       [status_none, status_test1, status_test] = json_response(any_test, :ok)
 355
 356       assert to_string(activity_test.id) == status_test["id"]
 357       assert to_string(activity_test1.id) == status_test1["id"]
 358       assert to_string(activity_none.id) == status_none["id"]
 359
 360       restricted_test =
 361         get(conn, "/api/v1/timelines/tag/test", %{"all" => ["test1"], "none" => ["none"]})
 362
 363       assert [status_test1] == json_response(restricted_test, :ok)
 364
 365       all_test = get(conn, "/api/v1/timelines/tag/test", %{"all" => ["none"]})
 366
 367       assert [status_none] == json_response(all_test, :ok)
 368     end
 369   end
 370 end