git.squeep.com Git - akkoma/blob - test/web/mastodon_api/controllers/timeline_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.TimelineControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   import Pleroma.Factory
   9   import Tesla.Mock
  10
  11   alias Pleroma.Config
  12   alias Pleroma.User
  13   alias Pleroma.Web.CommonAPI
  14
  15   setup do
  16     mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
  17     :ok
  18   end
  19
  20   describe "home" do
  21     setup do: oauth_access(["read:statuses"])
  22
  23     test "the home timeline", %{user: user, conn: conn} do
  24       following = insert(:user, nickname: "followed")
  25       third_user = insert(:user, nickname: "repeated")
  26
  27       {:ok, _activity} = CommonAPI.post(following, %{"status" => "post"})
  28       {:ok, activity} = CommonAPI.post(third_user, %{"status" => "repeated post"})
  29       {:ok, _, _} = CommonAPI.repeat(activity.id, following)
  30
  31       ret_conn = get(conn, "/api/v1/timelines/home")
  32
  33       assert Enum.empty?(json_response(ret_conn, :ok))
  34
  35       {:ok, _user} = User.follow(user, following)
  36
  37       ret_conn = get(conn, "/api/v1/timelines/home")
  38
  39       assert [
  40                %{
  41                  "reblog" => %{
  42                    "content" => "repeated post",
  43                    "account" => %{
  44                      "pleroma" => %{
  45                        "relationship" => %{"following" => false, "followed_by" => false}
  46                      }
  47                    }
  48                  },
  49                  "account" => %{"pleroma" => %{"relationship" => %{"following" => true}}}
  50                },
  51                %{
  52                  "content" => "post",
  53                  "account" => %{
  54                    "acct" => "followed",
  55                    "pleroma" => %{"relationship" => %{"following" => true}}
  56                  }
  57                }
  58              ] = json_response(ret_conn, :ok)
  59
  60       {:ok, _user} = User.follow(third_user, user)
  61
  62       ret_conn = get(conn, "/api/v1/timelines/home")
  63
  64       assert [
  65                %{
  66                  "reblog" => %{
  67                    "content" => "repeated post",
  68                    "account" => %{
  69                      "acct" => "repeated",
  70                      "pleroma" => %{
  71                        "relationship" => %{"following" => false, "followed_by" => true}
  72                      }
  73                    }
  74                  },
  75                  "account" => %{"pleroma" => %{"relationship" => %{"following" => true}}}
  76                },
  77                %{
  78                  "content" => "post",
  79                  "account" => %{
  80                    "acct" => "followed",
  81                    "pleroma" => %{"relationship" => %{"following" => true}}
  82                  }
  83                }
  84              ] = json_response(ret_conn, :ok)
  85     end
  86
  87     test "the home timeline when the direct messages are excluded", %{user: user, conn: conn} do
  88       {:ok, public_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "public"})
  89       {:ok, direct_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "direct"})
  90
  91       {:ok, unlisted_activity} =
  92         CommonAPI.post(user, %{"status" => ".", "visibility" => "unlisted"})
  93
  94       {:ok, private_activity} =
  95         CommonAPI.post(user, %{"status" => ".", "visibility" => "private"})
  96
  97       conn = get(conn, "/api/v1/timelines/home", %{"exclude_visibilities" => ["direct"]})
  98
  99       assert status_ids = json_response(conn, :ok) |> Enum.map(& &1["id"])
 100       assert public_activity.id in status_ids
 101       assert unlisted_activity.id in status_ids
 102       assert private_activity.id in status_ids
 103       refute direct_activity.id in status_ids
 104     end
 105   end
 106
 107   describe "public" do
 108     @tag capture_log: true
 109     test "the public timeline", %{conn: conn} do
 110       following = insert(:user)
 111
 112       {:ok, _activity} = CommonAPI.post(following, %{"status" => "test"})
 113
 114       _activity = insert(:note_activity, local: false)
 115
 116       conn = get(conn, "/api/v1/timelines/public", %{"local" => "False"})
 117
 118       assert length(json_response(conn, :ok)) == 2
 119
 120       conn = get(build_conn(), "/api/v1/timelines/public", %{"local" => "True"})
 121
 122       assert [%{"content" => "test"}] = json_response(conn, :ok)
 123
 124       conn = get(build_conn(), "/api/v1/timelines/public", %{"local" => "1"})
 125
 126       assert [%{"content" => "test"}] = json_response(conn, :ok)
 127     end
 128
 129     test "the public timeline includes only public statuses for an authenticated user" do
 130       %{user: user, conn: conn} = oauth_access(["read:statuses"])
 131
 132       {:ok, _activity} = CommonAPI.post(user, %{"status" => "test"})
 133       {:ok, _activity} = CommonAPI.post(user, %{"status" => "test", "visibility" => "private"})
 134       {:ok, _activity} = CommonAPI.post(user, %{"status" => "test", "visibility" => "unlisted"})
 135       {:ok, _activity} = CommonAPI.post(user, %{"status" => "test", "visibility" => "direct"})
 136
 137       res_conn = get(conn, "/api/v1/timelines/public")
 138       assert length(json_response(res_conn, 200)) == 1
 139     end
 140   end
 141
 142   defp local_and_remote_activities do
 143     insert(:note_activity)
 144     insert(:note_activity, local: false)
 145     :ok
 146   end
 147
 148   describe "public with restrict unauthenticated timeline for local and federated timelines" do
 149     setup do: local_and_remote_activities()
 150
 151     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 152
 153     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 154
 155     test "if user is unauthenticated", %{conn: conn} do
 156       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 157
 158       assert json_response(res_conn, :unauthorized) == %{
 159                "error" => "authorization required for timeline view"
 160              }
 161
 162       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 163
 164       assert json_response(res_conn, :unauthorized) == %{
 165                "error" => "authorization required for timeline view"
 166              }
 167     end
 168
 169     test "if user is authenticated" do
 170       %{conn: conn} = oauth_access(["read:statuses"])
 171
 172       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 173       assert length(json_response(res_conn, 200)) == 1
 174
 175       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 176       assert length(json_response(res_conn, 200)) == 2
 177     end
 178   end
 179
 180   describe "public with restrict unauthenticated timeline for local" do
 181     setup do: local_and_remote_activities()
 182
 183     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 184
 185     test "if user is unauthenticated", %{conn: conn} do
 186       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 187
 188       assert json_response(res_conn, :unauthorized) == %{
 189                "error" => "authorization required for timeline view"
 190              }
 191
 192       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 193       assert length(json_response(res_conn, 200)) == 2
 194     end
 195
 196     test "if user is authenticated", %{conn: _conn} do
 197       %{conn: conn} = oauth_access(["read:statuses"])
 198
 199       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 200       assert length(json_response(res_conn, 200)) == 1
 201
 202       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 203       assert length(json_response(res_conn, 200)) == 2
 204     end
 205   end
 206
 207   describe "public with restrict unauthenticated timeline for remote" do
 208     setup do: local_and_remote_activities()
 209
 210     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 211
 212     test "if user is unauthenticated", %{conn: conn} do
 213       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 214       assert length(json_response(res_conn, 200)) == 1
 215
 216       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 217
 218       assert json_response(res_conn, :unauthorized) == %{
 219                "error" => "authorization required for timeline view"
 220              }
 221     end
 222
 223     test "if user is authenticated", %{conn: _conn} do
 224       %{conn: conn} = oauth_access(["read:statuses"])
 225
 226       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 227       assert length(json_response(res_conn, 200)) == 1
 228
 229       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 230       assert length(json_response(res_conn, 200)) == 2
 231     end
 232   end
 233
 234   describe "direct" do
 235     test "direct timeline", %{conn: conn} do
 236       user_one = insert(:user)
 237       user_two = insert(:user)
 238
 239       {:ok, user_two} = User.follow(user_two, user_one)
 240
 241       {:ok, direct} =
 242         CommonAPI.post(user_one, %{
 243           "status" => "Hi @#{user_two.nickname}!",
 244           "visibility" => "direct"
 245         })
 246
 247       {:ok, _follower_only} =
 248         CommonAPI.post(user_one, %{
 249           "status" => "Hi @#{user_two.nickname}!",
 250           "visibility" => "private"
 251         })
 252
 253       conn_user_two =
 254         conn
 255         |> assign(:user, user_two)
 256         |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
 257
 258       # Only direct should be visible here
 259       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 260
 261       [status] = json_response(res_conn, :ok)
 262
 263       assert %{"visibility" => "direct"} = status
 264       assert status["url"] != direct.data["id"]
 265
 266       # User should be able to see their own direct message
 267       res_conn =
 268         build_conn()
 269         |> assign(:user, user_one)
 270         |> assign(:token, insert(:oauth_token, user: user_one, scopes: ["read:statuses"]))
 271         |> get("api/v1/timelines/direct")
 272
 273       [status] = json_response(res_conn, :ok)
 274
 275       assert %{"visibility" => "direct"} = status
 276
 277       # Both should be visible here
 278       res_conn = get(conn_user_two, "api/v1/timelines/home")
 279
 280       [_s1, _s2] = json_response(res_conn, :ok)
 281
 282       # Test pagination
 283       Enum.each(1..20, fn _ ->
 284         {:ok, _} =
 285           CommonAPI.post(user_one, %{
 286             "status" => "Hi @#{user_two.nickname}!",
 287             "visibility" => "direct"
 288           })
 289       end)
 290
 291       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 292
 293       statuses = json_response(res_conn, :ok)
 294       assert length(statuses) == 20
 295
 296       res_conn =
 297         get(conn_user_two, "api/v1/timelines/direct", %{max_id: List.last(statuses)["id"]})
 298
 299       [status] = json_response(res_conn, :ok)
 300
 301       assert status["url"] != direct.data["id"]
 302     end
 303
 304     test "doesn't include DMs from blocked users" do
 305       %{user: blocker, conn: conn} = oauth_access(["read:statuses"])
 306       blocked = insert(:user)
 307       other_user = insert(:user)
 308       {:ok, _user_relationship} = User.block(blocker, blocked)
 309
 310       {:ok, _blocked_direct} =
 311         CommonAPI.post(blocked, %{
 312           "status" => "Hi @#{blocker.nickname}!",
 313           "visibility" => "direct"
 314         })
 315
 316       {:ok, direct} =
 317         CommonAPI.post(other_user, %{
 318           "status" => "Hi @#{blocker.nickname}!",
 319           "visibility" => "direct"
 320         })
 321
 322       res_conn = get(conn, "api/v1/timelines/direct")
 323
 324       [status] = json_response(res_conn, :ok)
 325       assert status["id"] == direct.id
 326     end
 327   end
 328
 329   describe "list" do
 330     setup do: oauth_access(["read:lists"])
 331
 332     test "list timeline", %{user: user, conn: conn} do
 333       other_user = insert(:user)
 334       {:ok, _activity_one} = CommonAPI.post(user, %{"status" => "Marisa is cute."})
 335       {:ok, activity_two} = CommonAPI.post(other_user, %{"status" => "Marisa is cute."})
 336       {:ok, list} = Pleroma.List.create("name", user)
 337       {:ok, list} = Pleroma.List.follow(list, other_user)
 338
 339       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 340
 341       assert [%{"id" => id}] = json_response(conn, :ok)
 342
 343       assert id == to_string(activity_two.id)
 344     end
 345
 346     test "list timeline does not leak non-public statuses for unfollowed users", %{
 347       user: user,
 348       conn: conn
 349     } do
 350       other_user = insert(:user)
 351       {:ok, activity_one} = CommonAPI.post(other_user, %{"status" => "Marisa is cute."})
 352
 353       {:ok, _activity_two} =
 354         CommonAPI.post(other_user, %{
 355           "status" => "Marisa is cute.",
 356           "visibility" => "private"
 357         })
 358
 359       {:ok, list} = Pleroma.List.create("name", user)
 360       {:ok, list} = Pleroma.List.follow(list, other_user)
 361
 362       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 363
 364       assert [%{"id" => id}] = json_response(conn, :ok)
 365
 366       assert id == to_string(activity_one.id)
 367     end
 368   end
 369
 370   describe "hashtag" do
 371     setup do: oauth_access(["n/a"])
 372
 373     @tag capture_log: true
 374     test "hashtag timeline", %{conn: conn} do
 375       following = insert(:user)
 376
 377       {:ok, activity} = CommonAPI.post(following, %{"status" => "test #2hu"})
 378
 379       nconn = get(conn, "/api/v1/timelines/tag/2hu")
 380
 381       assert [%{"id" => id}] = json_response(nconn, :ok)
 382
 383       assert id == to_string(activity.id)
 384
 385       # works for different capitalization too
 386       nconn = get(conn, "/api/v1/timelines/tag/2HU")
 387
 388       assert [%{"id" => id}] = json_response(nconn, :ok)
 389
 390       assert id == to_string(activity.id)
 391     end
 392
 393     test "multi-hashtag timeline", %{conn: conn} do
 394       user = insert(:user)
 395
 396       {:ok, activity_test} = CommonAPI.post(user, %{"status" => "#test"})
 397       {:ok, activity_test1} = CommonAPI.post(user, %{"status" => "#test #test1"})
 398       {:ok, activity_none} = CommonAPI.post(user, %{"status" => "#test #none"})
 399
 400       any_test = get(conn, "/api/v1/timelines/tag/test", %{"any" => ["test1"]})
 401
 402       [status_none, status_test1, status_test] = json_response(any_test, :ok)
 403
 404       assert to_string(activity_test.id) == status_test["id"]
 405       assert to_string(activity_test1.id) == status_test1["id"]
 406       assert to_string(activity_none.id) == status_none["id"]
 407
 408       restricted_test =
 409         get(conn, "/api/v1/timelines/tag/test", %{"all" => ["test1"], "none" => ["none"]})
 410
 411       assert [status_test1] == json_response(restricted_test, :ok)
 412
 413       all_test = get(conn, "/api/v1/timelines/tag/test", %{"all" => ["none"]})
 414
 415       assert [status_none] == json_response(all_test, :ok)
 416     end
 417   end
 418 end