git.squeep.com Git - akkoma/blob - test/web/mastodon_api/controllers/timeline_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.TimelineControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   import Pleroma.Factory
   9   import Tesla.Mock
  10
  11   alias Pleroma.Config
  12   alias Pleroma.User
  13   alias Pleroma.Web.CommonAPI
  14
  15   setup do
  16     mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
  17     :ok
  18   end
  19
  20   describe "home" do
  21     setup do: oauth_access(["read:statuses"])
  22
  23     test "does NOT embed account/pleroma/relationship in statuses", %{
  24       user: user,
  25       conn: conn
  26     } do
  27       other_user = insert(:user)
  28
  29       {:ok, _} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})
  30
  31       response =
  32         conn
  33         |> assign(:user, user)
  34         |> get("/api/v1/timelines/home")
  35         |> json_response_and_validate_schema(200)
  36
  37       assert Enum.all?(response, fn n ->
  38                get_in(n, ["account", "pleroma", "relationship"]) == %{}
  39              end)
  40     end
  41
  42     test "the home timeline when the direct messages are excluded", %{user: user, conn: conn} do
  43       {:ok, public_activity} = CommonAPI.post(user, %{status: ".", visibility: "public"})
  44       {:ok, direct_activity} = CommonAPI.post(user, %{status: ".", visibility: "direct"})
  45
  46       {:ok, unlisted_activity} = CommonAPI.post(user, %{status: ".", visibility: "unlisted"})
  47
  48       {:ok, private_activity} = CommonAPI.post(user, %{status: ".", visibility: "private"})
  49
  50       conn = get(conn, "/api/v1/timelines/home?exclude_visibilities[]=direct")
  51
  52       assert status_ids = json_response_and_validate_schema(conn, :ok) |> Enum.map(& &1["id"])
  53       assert public_activity.id in status_ids
  54       assert unlisted_activity.id in status_ids
  55       assert private_activity.id in status_ids
  56       refute direct_activity.id in status_ids
  57     end
  58   end
  59
  60   describe "public" do
  61     @tag capture_log: true
  62     test "the public timeline", %{conn: conn} do
  63       following = insert(:user)
  64
  65       {:ok, _activity} = CommonAPI.post(following, %{status: "test"})
  66
  67       _activity = insert(:note_activity, local: false)
  68
  69       conn = get(conn, "/api/v1/timelines/public?local=False")
  70
  71       assert length(json_response_and_validate_schema(conn, :ok)) == 2
  72
  73       conn = get(build_conn(), "/api/v1/timelines/public?local=True")
  74
  75       assert [%{"content" => "test"}] = json_response_and_validate_schema(conn, :ok)
  76
  77       conn = get(build_conn(), "/api/v1/timelines/public?local=1")
  78
  79       assert [%{"content" => "test"}] = json_response_and_validate_schema(conn, :ok)
  80     end
  81
  82     test "the public timeline includes only public statuses for an authenticated user" do
  83       %{user: user, conn: conn} = oauth_access(["read:statuses"])
  84
  85       {:ok, _activity} = CommonAPI.post(user, %{status: "test"})
  86       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "private"})
  87       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "unlisted"})
  88       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "direct"})
  89
  90       res_conn = get(conn, "/api/v1/timelines/public")
  91       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
  92     end
  93
  94     test "doesn't return replies if follower is posting with blocked user" do
  95       %{conn: conn, user: blocker} = oauth_access(["read:statuses"])
  96       [blockee, friend] = insert_list(2, :user)
  97       {:ok, blocker} = User.follow(blocker, friend)
  98       {:ok, _} = User.block(blocker, blockee)
  99
 100       conn = assign(conn, :user, blocker)
 101
 102       {:ok, %{id: activity_id} = activity} = CommonAPI.post(friend, %{status: "hey!"})
 103
 104       {:ok, reply_from_blockee} =
 105         CommonAPI.post(blockee, %{status: "heya", in_reply_to_status_id: activity})
 106
 107       {:ok, _reply_from_friend} =
 108         CommonAPI.post(friend, %{status: "status", in_reply_to_status_id: reply_from_blockee})
 109
 110       res_conn = get(conn, "/api/v1/timelines/public")
 111       [%{"id" => ^activity_id}] = json_response_and_validate_schema(res_conn, 200)
 112     end
 113
 114     test "doesn't return replies if follow is posting with users from blocked domain" do
 115       %{conn: conn, user: blocker} = oauth_access(["read:statuses"])
 116       friend = insert(:user)
 117       blockee = insert(:user, ap_id: "https://example.com/users/blocked")
 118       {:ok, blocker} = User.follow(blocker, friend)
 119       {:ok, blocker} = User.block_domain(blocker, "example.com")
 120
 121       conn = assign(conn, :user, blocker)
 122
 123       {:ok, %{id: activity_id} = activity} = CommonAPI.post(friend, %{status: "hey!"})
 124
 125       {:ok, reply_from_blockee} =
 126         CommonAPI.post(blockee, %{status: "heya", in_reply_to_status_id: activity})
 127
 128       {:ok, _reply_from_friend} =
 129         CommonAPI.post(friend, %{status: "status", in_reply_to_status_id: reply_from_blockee})
 130
 131       res_conn = get(conn, "/api/v1/timelines/public")
 132
 133       activities = json_response_and_validate_schema(res_conn, 200)
 134       [%{"id" => ^activity_id}] = activities
 135     end
 136   end
 137
 138   defp local_and_remote_activities do
 139     insert(:note_activity)
 140     insert(:note_activity, local: false)
 141     :ok
 142   end
 143
 144   describe "public with restrict unauthenticated timeline for local and federated timelines" do
 145     setup do: local_and_remote_activities()
 146
 147     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 148
 149     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 150
 151     test "if user is unauthenticated", %{conn: conn} do
 152       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 153
 154       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 155                "error" => "authorization required for timeline view"
 156              }
 157
 158       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 159
 160       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 161                "error" => "authorization required for timeline view"
 162              }
 163     end
 164
 165     test "if user is authenticated" do
 166       %{conn: conn} = oauth_access(["read:statuses"])
 167
 168       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 169       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 170
 171       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 172       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 173     end
 174   end
 175
 176   describe "public with restrict unauthenticated timeline for local" do
 177     setup do: local_and_remote_activities()
 178
 179     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 180
 181     test "if user is unauthenticated", %{conn: conn} do
 182       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 183
 184       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 185                "error" => "authorization required for timeline view"
 186              }
 187
 188       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 189       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 190     end
 191
 192     test "if user is authenticated", %{conn: _conn} do
 193       %{conn: conn} = oauth_access(["read:statuses"])
 194
 195       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 196       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 197
 198       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 199       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 200     end
 201   end
 202
 203   describe "public with restrict unauthenticated timeline for remote" do
 204     setup do: local_and_remote_activities()
 205
 206     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 207
 208     test "if user is unauthenticated", %{conn: conn} do
 209       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 210       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 211
 212       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 213
 214       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 215                "error" => "authorization required for timeline view"
 216              }
 217     end
 218
 219     test "if user is authenticated", %{conn: _conn} do
 220       %{conn: conn} = oauth_access(["read:statuses"])
 221
 222       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 223       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 224
 225       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 226       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 227     end
 228   end
 229
 230   describe "direct" do
 231     test "direct timeline", %{conn: conn} do
 232       user_one = insert(:user)
 233       user_two = insert(:user)
 234
 235       {:ok, user_two} = User.follow(user_two, user_one)
 236
 237       {:ok, direct} =
 238         CommonAPI.post(user_one, %{
 239           status: "Hi @#{user_two.nickname}!",
 240           visibility: "direct"
 241         })
 242
 243       {:ok, _follower_only} =
 244         CommonAPI.post(user_one, %{
 245           status: "Hi @#{user_two.nickname}!",
 246           visibility: "private"
 247         })
 248
 249       conn_user_two =
 250         conn
 251         |> assign(:user, user_two)
 252         |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
 253
 254       # Only direct should be visible here
 255       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 256
 257       assert [status] = json_response_and_validate_schema(res_conn, :ok)
 258
 259       assert %{"visibility" => "direct"} = status
 260       assert status["url"] != direct.data["id"]
 261
 262       # User should be able to see their own direct message
 263       res_conn =
 264         build_conn()
 265         |> assign(:user, user_one)
 266         |> assign(:token, insert(:oauth_token, user: user_one, scopes: ["read:statuses"]))
 267         |> get("api/v1/timelines/direct")
 268
 269       [status] = json_response_and_validate_schema(res_conn, :ok)
 270
 271       assert %{"visibility" => "direct"} = status
 272
 273       # Both should be visible here
 274       res_conn = get(conn_user_two, "api/v1/timelines/home")
 275
 276       [_s1, _s2] = json_response_and_validate_schema(res_conn, :ok)
 277
 278       # Test pagination
 279       Enum.each(1..20, fn _ ->
 280         {:ok, _} =
 281           CommonAPI.post(user_one, %{
 282             status: "Hi @#{user_two.nickname}!",
 283             visibility: "direct"
 284           })
 285       end)
 286
 287       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 288
 289       statuses = json_response_and_validate_schema(res_conn, :ok)
 290       assert length(statuses) == 20
 291
 292       max_id = List.last(statuses)["id"]
 293
 294       res_conn = get(conn_user_two, "api/v1/timelines/direct?max_id=#{max_id}")
 295
 296       assert [status] = json_response_and_validate_schema(res_conn, :ok)
 297
 298       assert status["url"] != direct.data["id"]
 299     end
 300
 301     test "doesn't include DMs from blocked users" do
 302       %{user: blocker, conn: conn} = oauth_access(["read:statuses"])
 303       blocked = insert(:user)
 304       other_user = insert(:user)
 305       {:ok, _user_relationship} = User.block(blocker, blocked)
 306
 307       {:ok, _blocked_direct} =
 308         CommonAPI.post(blocked, %{
 309           status: "Hi @#{blocker.nickname}!",
 310           visibility: "direct"
 311         })
 312
 313       {:ok, direct} =
 314         CommonAPI.post(other_user, %{
 315           status: "Hi @#{blocker.nickname}!",
 316           visibility: "direct"
 317         })
 318
 319       res_conn = get(conn, "api/v1/timelines/direct")
 320
 321       [status] = json_response_and_validate_schema(res_conn, :ok)
 322       assert status["id"] == direct.id
 323     end
 324   end
 325
 326   describe "list" do
 327     setup do: oauth_access(["read:lists"])
 328
 329     test "list timeline", %{user: user, conn: conn} do
 330       other_user = insert(:user)
 331       {:ok, _activity_one} = CommonAPI.post(user, %{status: "Marisa is cute."})
 332       {:ok, activity_two} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 333       {:ok, list} = Pleroma.List.create("name", user)
 334       {:ok, list} = Pleroma.List.follow(list, other_user)
 335
 336       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 337
 338       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 339
 340       assert id == to_string(activity_two.id)
 341     end
 342
 343     test "list timeline does not leak non-public statuses for unfollowed users", %{
 344       user: user,
 345       conn: conn
 346     } do
 347       other_user = insert(:user)
 348       {:ok, activity_one} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 349
 350       {:ok, _activity_two} =
 351         CommonAPI.post(other_user, %{
 352           status: "Marisa is cute.",
 353           visibility: "private"
 354         })
 355
 356       {:ok, list} = Pleroma.List.create("name", user)
 357       {:ok, list} = Pleroma.List.follow(list, other_user)
 358
 359       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 360
 361       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 362
 363       assert id == to_string(activity_one.id)
 364     end
 365   end
 366
 367   describe "hashtag" do
 368     setup do: oauth_access(["n/a"])
 369
 370     @tag capture_log: true
 371     test "hashtag timeline", %{conn: conn} do
 372       following = insert(:user)
 373
 374       {:ok, activity} = CommonAPI.post(following, %{status: "test #2hu"})
 375
 376       nconn = get(conn, "/api/v1/timelines/tag/2hu")
 377
 378       assert [%{"id" => id}] = json_response_and_validate_schema(nconn, :ok)
 379
 380       assert id == to_string(activity.id)
 381
 382       # works for different capitalization too
 383       nconn = get(conn, "/api/v1/timelines/tag/2HU")
 384
 385       assert [%{"id" => id}] = json_response_and_validate_schema(nconn, :ok)
 386
 387       assert id == to_string(activity.id)
 388     end
 389
 390     test "multi-hashtag timeline", %{conn: conn} do
 391       user = insert(:user)
 392
 393       {:ok, activity_test} = CommonAPI.post(user, %{status: "#test"})
 394       {:ok, activity_test1} = CommonAPI.post(user, %{status: "#test #test1"})
 395       {:ok, activity_none} = CommonAPI.post(user, %{status: "#test #none"})
 396
 397       any_test = get(conn, "/api/v1/timelines/tag/test?any[]=test1")
 398
 399       [status_none, status_test1, status_test] = json_response_and_validate_schema(any_test, :ok)
 400
 401       assert to_string(activity_test.id) == status_test["id"]
 402       assert to_string(activity_test1.id) == status_test1["id"]
 403       assert to_string(activity_none.id) == status_none["id"]
 404
 405       restricted_test = get(conn, "/api/v1/timelines/tag/test?all[]=test1&none[]=none")
 406
 407       assert [status_test1] == json_response_and_validate_schema(restricted_test, :ok)
 408
 409       all_test = get(conn, "/api/v1/timelines/tag/test?all[]=none")
 410
 411       assert [status_none] == json_response_and_validate_schema(all_test, :ok)
 412     end
 413   end
 414 end