1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Web.MastodonAPI.TimelineControllerTest do
6 use Pleroma.Web.ConnCase
13 alias Pleroma.Web.CommonAPI
16 mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
21 setup do: oauth_access(["read:statuses"])
23 test "the home timeline", %{user: user, conn: conn} do
24 following = insert(:user, nickname: "followed")
25 third_user = insert(:user, nickname: "repeated")
27 {:ok, _activity} = CommonAPI.post(following, %{"status" => "post"})
28 {:ok, activity} = CommonAPI.post(third_user, %{"status" => "repeated post"})
29 {:ok, _, _} = CommonAPI.repeat(activity.id, following)
31 ret_conn = get(conn, "/api/v1/timelines/home")
33 assert Enum.empty?(json_response(ret_conn, :ok))
35 {:ok, _user} = User.follow(user, following)
37 ret_conn = get(conn, "/api/v1/timelines/home")
42 "content" => "repeated post",
45 "relationship" => %{"following" => false, "followed_by" => false}
49 "account" => %{"pleroma" => %{"relationship" => %{"following" => true}}}
55 "pleroma" => %{"relationship" => %{"following" => true}}
58 ] = json_response(ret_conn, :ok)
60 {:ok, _user} = User.follow(third_user, user)
62 ret_conn = get(conn, "/api/v1/timelines/home")
67 "content" => "repeated post",
71 "relationship" => %{"following" => false, "followed_by" => true}
75 "account" => %{"pleroma" => %{"relationship" => %{"following" => true}}}
81 "pleroma" => %{"relationship" => %{"following" => true}}
84 ] = json_response(ret_conn, :ok)
87 test "the home timeline when the direct messages are excluded", %{user: user, conn: conn} do
88 {:ok, public_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "public"})
89 {:ok, direct_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "direct"})
91 {:ok, unlisted_activity} =
92 CommonAPI.post(user, %{"status" => ".", "visibility" => "unlisted"})
94 {:ok, private_activity} =
95 CommonAPI.post(user, %{"status" => ".", "visibility" => "private"})
97 conn = get(conn, "/api/v1/timelines/home", %{"exclude_visibilities" => ["direct"]})
99 assert status_ids = json_response(conn, :ok) |> Enum.map(& &1["id"])
100 assert public_activity.id in status_ids
101 assert unlisted_activity.id in status_ids
102 assert private_activity.id in status_ids
103 refute direct_activity.id in status_ids
108 @tag capture_log: true
109 test "the public timeline", %{conn: conn} do
110 following = insert(:user)
112 {:ok, _activity} = CommonAPI.post(following, %{"status" => "test"})
114 _activity = insert(:note_activity, local: false)
116 conn = get(conn, "/api/v1/timelines/public", %{"local" => "False"})
118 assert length(json_response(conn, :ok)) == 2
120 conn = get(build_conn(), "/api/v1/timelines/public", %{"local" => "True"})
122 assert [%{"content" => "test"}] = json_response(conn, :ok)
124 conn = get(build_conn(), "/api/v1/timelines/public", %{"local" => "1"})
126 assert [%{"content" => "test"}] = json_response(conn, :ok)
129 test "the public timeline includes only public statuses for an authenticated user" do
130 %{user: user, conn: conn} = oauth_access(["read:statuses"])
132 {:ok, _activity} = CommonAPI.post(user, %{"status" => "test"})
133 {:ok, _activity} = CommonAPI.post(user, %{"status" => "test", "visibility" => "private"})
134 {:ok, _activity} = CommonAPI.post(user, %{"status" => "test", "visibility" => "unlisted"})
135 {:ok, _activity} = CommonAPI.post(user, %{"status" => "test", "visibility" => "direct"})
137 res_conn = get(conn, "/api/v1/timelines/public")
138 assert length(json_response(res_conn, 200)) == 1
142 defp local_and_remote_activities do
143 insert(:note_activity)
144 insert(:note_activity, local: false)
148 describe "public with restrict unauthenticated timeline for local and federated timelines" do
149 setup do: local_and_remote_activities()
151 setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
153 setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
155 test "if user is unauthenticated", %{conn: conn} do
156 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
158 assert json_response(res_conn, :unauthorized) == %{
159 "error" => "authorization required for timeline view"
162 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
164 assert json_response(res_conn, :unauthorized) == %{
165 "error" => "authorization required for timeline view"
169 test "if user is authenticated" do
170 %{conn: conn} = oauth_access(["read:statuses"])
172 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
173 assert length(json_response(res_conn, 200)) == 1
175 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
176 assert length(json_response(res_conn, 200)) == 2
180 describe "public with restrict unauthenticated timeline for local" do
181 setup do: local_and_remote_activities()
183 setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
185 test "if user is unauthenticated", %{conn: conn} do
186 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
188 assert json_response(res_conn, :unauthorized) == %{
189 "error" => "authorization required for timeline view"
192 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
193 assert length(json_response(res_conn, 200)) == 2
196 test "if user is authenticated", %{conn: _conn} do
197 %{conn: conn} = oauth_access(["read:statuses"])
199 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
200 assert length(json_response(res_conn, 200)) == 1
202 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
203 assert length(json_response(res_conn, 200)) == 2
207 describe "public with restrict unauthenticated timeline for remote" do
208 setup do: local_and_remote_activities()
210 setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
212 test "if user is unauthenticated", %{conn: conn} do
213 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
214 assert length(json_response(res_conn, 200)) == 1
216 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
218 assert json_response(res_conn, :unauthorized) == %{
219 "error" => "authorization required for timeline view"
223 test "if user is authenticated", %{conn: _conn} do
224 %{conn: conn} = oauth_access(["read:statuses"])
226 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
227 assert length(json_response(res_conn, 200)) == 1
229 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
230 assert length(json_response(res_conn, 200)) == 2
235 test "direct timeline", %{conn: conn} do
236 user_one = insert(:user)
237 user_two = insert(:user)
239 {:ok, user_two} = User.follow(user_two, user_one)
242 CommonAPI.post(user_one, %{
243 "status" => "Hi @#{user_two.nickname}!",
244 "visibility" => "direct"
247 {:ok, _follower_only} =
248 CommonAPI.post(user_one, %{
249 "status" => "Hi @#{user_two.nickname}!",
250 "visibility" => "private"
255 |> assign(:user, user_two)
256 |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
258 # Only direct should be visible here
259 res_conn = get(conn_user_two, "api/v1/timelines/direct")
261 [status] = json_response(res_conn, :ok)
263 assert %{"visibility" => "direct"} = status
264 assert status["url"] != direct.data["id"]
266 # User should be able to see their own direct message
269 |> assign(:user, user_one)
270 |> assign(:token, insert(:oauth_token, user: user_one, scopes: ["read:statuses"]))
271 |> get("api/v1/timelines/direct")
273 [status] = json_response(res_conn, :ok)
275 assert %{"visibility" => "direct"} = status
277 # Both should be visible here
278 res_conn = get(conn_user_two, "api/v1/timelines/home")
280 [_s1, _s2] = json_response(res_conn, :ok)
283 Enum.each(1..20, fn _ ->
285 CommonAPI.post(user_one, %{
286 "status" => "Hi @#{user_two.nickname}!",
287 "visibility" => "direct"
291 res_conn = get(conn_user_two, "api/v1/timelines/direct")
293 statuses = json_response(res_conn, :ok)
294 assert length(statuses) == 20
297 get(conn_user_two, "api/v1/timelines/direct", %{max_id: List.last(statuses)["id"]})
299 [status] = json_response(res_conn, :ok)
301 assert status["url"] != direct.data["id"]
304 test "doesn't include DMs from blocked users" do
305 %{user: blocker, conn: conn} = oauth_access(["read:statuses"])
306 blocked = insert(:user)
307 other_user = insert(:user)
308 {:ok, _user_relationship} = User.block(blocker, blocked)
310 {:ok, _blocked_direct} =
311 CommonAPI.post(blocked, %{
312 "status" => "Hi @#{blocker.nickname}!",
313 "visibility" => "direct"
317 CommonAPI.post(other_user, %{
318 "status" => "Hi @#{blocker.nickname}!",
319 "visibility" => "direct"
322 res_conn = get(conn, "api/v1/timelines/direct")
324 [status] = json_response(res_conn, :ok)
325 assert status["id"] == direct.id
330 setup do: oauth_access(["read:lists"])
332 test "list timeline", %{user: user, conn: conn} do
333 other_user = insert(:user)
334 {:ok, _activity_one} = CommonAPI.post(user, %{"status" => "Marisa is cute."})
335 {:ok, activity_two} = CommonAPI.post(other_user, %{"status" => "Marisa is cute."})
336 {:ok, list} = Pleroma.List.create("name", user)
337 {:ok, list} = Pleroma.List.follow(list, other_user)
339 conn = get(conn, "/api/v1/timelines/list/#{list.id}")
341 assert [%{"id" => id}] = json_response(conn, :ok)
343 assert id == to_string(activity_two.id)
346 test "list timeline does not leak non-public statuses for unfollowed users", %{
350 other_user = insert(:user)
351 {:ok, activity_one} = CommonAPI.post(other_user, %{"status" => "Marisa is cute."})
353 {:ok, _activity_two} =
354 CommonAPI.post(other_user, %{
355 "status" => "Marisa is cute.",
356 "visibility" => "private"
359 {:ok, list} = Pleroma.List.create("name", user)
360 {:ok, list} = Pleroma.List.follow(list, other_user)
362 conn = get(conn, "/api/v1/timelines/list/#{list.id}")
364 assert [%{"id" => id}] = json_response(conn, :ok)
366 assert id == to_string(activity_one.id)
370 describe "hashtag" do
371 setup do: oauth_access(["n/a"])
373 @tag capture_log: true
374 test "hashtag timeline", %{conn: conn} do
375 following = insert(:user)
377 {:ok, activity} = CommonAPI.post(following, %{"status" => "test #2hu"})
379 nconn = get(conn, "/api/v1/timelines/tag/2hu")
381 assert [%{"id" => id}] = json_response(nconn, :ok)
383 assert id == to_string(activity.id)
385 # works for different capitalization too
386 nconn = get(conn, "/api/v1/timelines/tag/2HU")
388 assert [%{"id" => id}] = json_response(nconn, :ok)
390 assert id == to_string(activity.id)
393 test "multi-hashtag timeline", %{conn: conn} do
396 {:ok, activity_test} = CommonAPI.post(user, %{"status" => "#test"})
397 {:ok, activity_test1} = CommonAPI.post(user, %{"status" => "#test #test1"})
398 {:ok, activity_none} = CommonAPI.post(user, %{"status" => "#test #none"})
400 any_test = get(conn, "/api/v1/timelines/tag/test", %{"any" => ["test1"]})
402 [status_none, status_test1, status_test] = json_response(any_test, :ok)
404 assert to_string(activity_test.id) == status_test["id"]
405 assert to_string(activity_test1.id) == status_test1["id"]
406 assert to_string(activity_none.id) == status_none["id"]
409 get(conn, "/api/v1/timelines/tag/test", %{"all" => ["test1"], "none" => ["none"]})
411 assert [status_test1] == json_response(restricted_test, :ok)
413 all_test = get(conn, "/api/v1/timelines/tag/test", %{"all" => ["none"]})
415 assert [status_none] == json_response(all_test, :ok)