git.squeep.com Git - akkoma/blob - test/web/mastodon_api/controllers/timeline_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.TimelineControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   import Pleroma.Factory
   9   import Tesla.Mock
  10
  11   alias Pleroma.Config
  12   alias Pleroma.User
  13   alias Pleroma.Web.CommonAPI
  14
  15   setup do
  16     mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
  17     :ok
  18   end
  19
  20   describe "home" do
  21     setup do: oauth_access(["read:statuses"])
  22
  23     test "does NOT embed account/pleroma/relationship in statuses", %{
  24       user: user,
  25       conn: conn
  26     } do
  27       other_user = insert(:user)
  28
  29       {:ok, _} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})
  30
  31       response =
  32         conn
  33         |> assign(:user, user)
  34         |> get("/api/v1/timelines/home")
  35         |> json_response_and_validate_schema(200)
  36
  37       assert Enum.all?(response, fn n ->
  38                get_in(n, ["account", "pleroma", "relationship"]) == %{}
  39              end)
  40     end
  41
  42     test "the home timeline when the direct messages are excluded", %{user: user, conn: conn} do
  43       {:ok, public_activity} = CommonAPI.post(user, %{status: ".", visibility: "public"})
  44       {:ok, direct_activity} = CommonAPI.post(user, %{status: ".", visibility: "direct"})
  45
  46       {:ok, unlisted_activity} = CommonAPI.post(user, %{status: ".", visibility: "unlisted"})
  47
  48       {:ok, private_activity} = CommonAPI.post(user, %{status: ".", visibility: "private"})
  49
  50       conn = get(conn, "/api/v1/timelines/home?exclude_visibilities[]=direct")
  51
  52       assert status_ids = json_response_and_validate_schema(conn, :ok) |> Enum.map(& &1["id"])
  53       assert public_activity.id in status_ids
  54       assert unlisted_activity.id in status_ids
  55       assert private_activity.id in status_ids
  56       refute direct_activity.id in status_ids
  57     end
  58   end
  59
  60   describe "public" do
  61     @tag capture_log: true
  62     test "the public timeline", %{conn: conn} do
  63       user = insert(:user)
  64
  65       {:ok, activity} = CommonAPI.post(user, %{status: "test"})
  66
  67       _activity = insert(:note_activity, local: false)
  68
  69       conn = get(conn, "/api/v1/timelines/public?local=False")
  70
  71       assert length(json_response_and_validate_schema(conn, :ok)) == 2
  72
  73       conn = get(build_conn(), "/api/v1/timelines/public?local=True")
  74
  75       assert [%{"content" => "test"}] = json_response_and_validate_schema(conn, :ok)
  76
  77       conn = get(build_conn(), "/api/v1/timelines/public?local=1")
  78
  79       assert [%{"content" => "test"}] = json_response_and_validate_schema(conn, :ok)
  80
  81       # does not contain repeats
  82       {:ok, _} = CommonAPI.repeat(activity.id, user)
  83
  84       conn = get(build_conn(), "/api/v1/timelines/public?local=true")
  85
  86       assert [_] = json_response_and_validate_schema(conn, :ok)
  87     end
  88
  89     test "the public timeline includes only public statuses for an authenticated user" do
  90       %{user: user, conn: conn} = oauth_access(["read:statuses"])
  91
  92       {:ok, _activity} = CommonAPI.post(user, %{status: "test"})
  93       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "private"})
  94       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "unlisted"})
  95       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "direct"})
  96
  97       res_conn = get(conn, "/api/v1/timelines/public")
  98       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
  99     end
 100
 101     test "doesn't return replies if follower is posting with blocked user" do
 102       %{conn: conn, user: blocker} = oauth_access(["read:statuses"])
 103       [blockee, friend] = insert_list(2, :user)
 104       {:ok, blocker} = User.follow(blocker, friend)
 105       {:ok, _} = User.block(blocker, blockee)
 106
 107       conn = assign(conn, :user, blocker)
 108
 109       {:ok, %{id: activity_id} = activity} = CommonAPI.post(friend, %{status: "hey!"})
 110
 111       {:ok, reply_from_blockee} =
 112         CommonAPI.post(blockee, %{status: "heya", in_reply_to_status_id: activity})
 113
 114       {:ok, _reply_from_friend} =
 115         CommonAPI.post(friend, %{status: "status", in_reply_to_status_id: reply_from_blockee})
 116
 117       res_conn = get(conn, "/api/v1/timelines/public")
 118       [%{"id" => ^activity_id}] = json_response_and_validate_schema(res_conn, 200)
 119     end
 120
 121     test "doesn't return replies if follow is posting with users from blocked domain" do
 122       %{conn: conn, user: blocker} = oauth_access(["read:statuses"])
 123       friend = insert(:user)
 124       blockee = insert(:user, ap_id: "https://example.com/users/blocked")
 125       {:ok, blocker} = User.follow(blocker, friend)
 126       {:ok, blocker} = User.block_domain(blocker, "example.com")
 127
 128       conn = assign(conn, :user, blocker)
 129
 130       {:ok, %{id: activity_id} = activity} = CommonAPI.post(friend, %{status: "hey!"})
 131
 132       {:ok, reply_from_blockee} =
 133         CommonAPI.post(blockee, %{status: "heya", in_reply_to_status_id: activity})
 134
 135       {:ok, _reply_from_friend} =
 136         CommonAPI.post(friend, %{status: "status", in_reply_to_status_id: reply_from_blockee})
 137
 138       res_conn = get(conn, "/api/v1/timelines/public")
 139
 140       activities = json_response_and_validate_schema(res_conn, 200)
 141       [%{"id" => ^activity_id}] = activities
 142     end
 143   end
 144
 145   defp local_and_remote_activities do
 146     insert(:note_activity)
 147     insert(:note_activity, local: false)
 148     :ok
 149   end
 150
 151   describe "public with restrict unauthenticated timeline for local and federated timelines" do
 152     setup do: local_and_remote_activities()
 153
 154     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 155
 156     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 157
 158     test "if user is unauthenticated", %{conn: conn} do
 159       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 160
 161       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 162                "error" => "authorization required for timeline view"
 163              }
 164
 165       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 166
 167       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 168                "error" => "authorization required for timeline view"
 169              }
 170     end
 171
 172     test "if user is authenticated" do
 173       %{conn: conn} = oauth_access(["read:statuses"])
 174
 175       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 176       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 177
 178       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 179       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 180     end
 181   end
 182
 183   describe "public with restrict unauthenticated timeline for local" do
 184     setup do: local_and_remote_activities()
 185
 186     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 187
 188     test "if user is unauthenticated", %{conn: conn} do
 189       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 190
 191       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 192                "error" => "authorization required for timeline view"
 193              }
 194
 195       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 196       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 197     end
 198
 199     test "if user is authenticated", %{conn: _conn} do
 200       %{conn: conn} = oauth_access(["read:statuses"])
 201
 202       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 203       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 204
 205       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 206       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 207     end
 208   end
 209
 210   describe "public with restrict unauthenticated timeline for remote" do
 211     setup do: local_and_remote_activities()
 212
 213     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 214
 215     test "if user is unauthenticated", %{conn: conn} do
 216       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 217       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 218
 219       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 220
 221       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 222                "error" => "authorization required for timeline view"
 223              }
 224     end
 225
 226     test "if user is authenticated", %{conn: _conn} do
 227       %{conn: conn} = oauth_access(["read:statuses"])
 228
 229       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 230       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 231
 232       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 233       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 234     end
 235   end
 236
 237   describe "direct" do
 238     test "direct timeline", %{conn: conn} do
 239       user_one = insert(:user)
 240       user_two = insert(:user)
 241
 242       {:ok, user_two} = User.follow(user_two, user_one)
 243
 244       {:ok, direct} =
 245         CommonAPI.post(user_one, %{
 246           status: "Hi @#{user_two.nickname}!",
 247           visibility: "direct"
 248         })
 249
 250       {:ok, _follower_only} =
 251         CommonAPI.post(user_one, %{
 252           status: "Hi @#{user_two.nickname}!",
 253           visibility: "private"
 254         })
 255
 256       conn_user_two =
 257         conn
 258         |> assign(:user, user_two)
 259         |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
 260
 261       # Only direct should be visible here
 262       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 263
 264       assert [status] = json_response_and_validate_schema(res_conn, :ok)
 265
 266       assert %{"visibility" => "direct"} = status
 267       assert status["url"] != direct.data["id"]
 268
 269       # User should be able to see their own direct message
 270       res_conn =
 271         build_conn()
 272         |> assign(:user, user_one)
 273         |> assign(:token, insert(:oauth_token, user: user_one, scopes: ["read:statuses"]))
 274         |> get("api/v1/timelines/direct")
 275
 276       [status] = json_response_and_validate_schema(res_conn, :ok)
 277
 278       assert %{"visibility" => "direct"} = status
 279
 280       # Both should be visible here
 281       res_conn = get(conn_user_two, "api/v1/timelines/home")
 282
 283       [_s1, _s2] = json_response_and_validate_schema(res_conn, :ok)
 284
 285       # Test pagination
 286       Enum.each(1..20, fn _ ->
 287         {:ok, _} =
 288           CommonAPI.post(user_one, %{
 289             status: "Hi @#{user_two.nickname}!",
 290             visibility: "direct"
 291           })
 292       end)
 293
 294       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 295
 296       statuses = json_response_and_validate_schema(res_conn, :ok)
 297       assert length(statuses) == 20
 298
 299       max_id = List.last(statuses)["id"]
 300
 301       res_conn = get(conn_user_two, "api/v1/timelines/direct?max_id=#{max_id}")
 302
 303       assert [status] = json_response_and_validate_schema(res_conn, :ok)
 304
 305       assert status["url"] != direct.data["id"]
 306     end
 307
 308     test "doesn't include DMs from blocked users" do
 309       %{user: blocker, conn: conn} = oauth_access(["read:statuses"])
 310       blocked = insert(:user)
 311       other_user = insert(:user)
 312       {:ok, _user_relationship} = User.block(blocker, blocked)
 313
 314       {:ok, _blocked_direct} =
 315         CommonAPI.post(blocked, %{
 316           status: "Hi @#{blocker.nickname}!",
 317           visibility: "direct"
 318         })
 319
 320       {:ok, direct} =
 321         CommonAPI.post(other_user, %{
 322           status: "Hi @#{blocker.nickname}!",
 323           visibility: "direct"
 324         })
 325
 326       res_conn = get(conn, "api/v1/timelines/direct")
 327
 328       [status] = json_response_and_validate_schema(res_conn, :ok)
 329       assert status["id"] == direct.id
 330     end
 331   end
 332
 333   describe "list" do
 334     setup do: oauth_access(["read:lists"])
 335
 336     test "does not contain retoots", %{user: user, conn: conn} do
 337       other_user = insert(:user)
 338       {:ok, activity_one} = CommonAPI.post(user, %{status: "Marisa is cute."})
 339       {:ok, activity_two} = CommonAPI.post(other_user, %{status: "Marisa is stupid."})
 340       {:ok, _} = CommonAPI.repeat(activity_one.id, other_user)
 341
 342       {:ok, list} = Pleroma.List.create("name", user)
 343       {:ok, list} = Pleroma.List.follow(list, other_user)
 344
 345       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 346
 347       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 348
 349       assert id == to_string(activity_two.id)
 350     end
 351
 352     test "works with pagination", %{user: user, conn: conn} do
 353       other_user = insert(:user)
 354       {:ok, list} = Pleroma.List.create("name", user)
 355       {:ok, list} = Pleroma.List.follow(list, other_user)
 356
 357       Enum.each(1..30, fn i ->
 358         CommonAPI.post(other_user, %{status: "post number #{i}"})
 359       end)
 360
 361       res =
 362         get(conn, "/api/v1/timelines/list/#{list.id}?limit=1")
 363         |> json_response_and_validate_schema(:ok)
 364
 365       assert length(res) == 1
 366
 367       [first] = res
 368
 369       res =
 370         get(conn, "/api/v1/timelines/list/#{list.id}?max_id=#{first["id"]}&limit=30")
 371         |> json_response_and_validate_schema(:ok)
 372
 373       assert length(res) == 29
 374     end
 375
 376     test "list timeline", %{user: user, conn: conn} do
 377       other_user = insert(:user)
 378       {:ok, _activity_one} = CommonAPI.post(user, %{status: "Marisa is cute."})
 379       {:ok, activity_two} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 380       {:ok, list} = Pleroma.List.create("name", user)
 381       {:ok, list} = Pleroma.List.follow(list, other_user)
 382
 383       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 384
 385       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 386
 387       assert id == to_string(activity_two.id)
 388     end
 389
 390     test "list timeline does not leak non-public statuses for unfollowed users", %{
 391       user: user,
 392       conn: conn
 393     } do
 394       other_user = insert(:user)
 395       {:ok, activity_one} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 396
 397       {:ok, _activity_two} =
 398         CommonAPI.post(other_user, %{
 399           status: "Marisa is cute.",
 400           visibility: "private"
 401         })
 402
 403       {:ok, list} = Pleroma.List.create("name", user)
 404       {:ok, list} = Pleroma.List.follow(list, other_user)
 405
 406       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 407
 408       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 409
 410       assert id == to_string(activity_one.id)
 411     end
 412   end
 413
 414   describe "hashtag" do
 415     setup do: oauth_access(["n/a"])
 416
 417     @tag capture_log: true
 418     test "hashtag timeline", %{conn: conn} do
 419       following = insert(:user)
 420
 421       {:ok, activity} = CommonAPI.post(following, %{status: "test #2hu"})
 422
 423       nconn = get(conn, "/api/v1/timelines/tag/2hu")
 424
 425       assert [%{"id" => id}] = json_response_and_validate_schema(nconn, :ok)
 426
 427       assert id == to_string(activity.id)
 428
 429       # works for different capitalization too
 430       nconn = get(conn, "/api/v1/timelines/tag/2HU")
 431
 432       assert [%{"id" => id}] = json_response_and_validate_schema(nconn, :ok)
 433
 434       assert id == to_string(activity.id)
 435     end
 436
 437     test "multi-hashtag timeline", %{conn: conn} do
 438       user = insert(:user)
 439
 440       {:ok, activity_test} = CommonAPI.post(user, %{status: "#test"})
 441       {:ok, activity_test1} = CommonAPI.post(user, %{status: "#test #test1"})
 442       {:ok, activity_none} = CommonAPI.post(user, %{status: "#test #none"})
 443
 444       any_test = get(conn, "/api/v1/timelines/tag/test?any[]=test1")
 445
 446       [status_none, status_test1, status_test] = json_response_and_validate_schema(any_test, :ok)
 447
 448       assert to_string(activity_test.id) == status_test["id"]
 449       assert to_string(activity_test1.id) == status_test1["id"]
 450       assert to_string(activity_none.id) == status_none["id"]
 451
 452       restricted_test = get(conn, "/api/v1/timelines/tag/test?all[]=test1&none[]=none")
 453
 454       assert [status_test1] == json_response_and_validate_schema(restricted_test, :ok)
 455
 456       all_test = get(conn, "/api/v1/timelines/tag/test?all[]=none")
 457
 458       assert [status_none] == json_response_and_validate_schema(all_test, :ok)
 459     end
 460   end
 461
 462   describe "hashtag timeline handling of :restrict_unauthenticated setting" do
 463     setup do
 464       user = insert(:user)
 465       {:ok, activity1} = CommonAPI.post(user, %{status: "test #tag1"})
 466       {:ok, _activity2} = CommonAPI.post(user, %{status: "test #tag1"})
 467
 468       activity1
 469       |> Ecto.Changeset.change(%{local: false})
 470       |> Pleroma.Repo.update()
 471
 472       base_uri = "/api/v1/timelines/tag/tag1"
 473       error_response = %{"error" => "authorization required for timeline view"}
 474
 475       %{base_uri: base_uri, error_response: error_response}
 476     end
 477
 478     defp ensure_authenticated_access(base_uri) do
 479       %{conn: auth_conn} = oauth_access(["read:statuses"])
 480
 481       res_conn = get(auth_conn, "#{base_uri}?local=true")
 482       assert length(json_response(res_conn, 200)) == 1
 483
 484       res_conn = get(auth_conn, "#{base_uri}?local=false")
 485       assert length(json_response(res_conn, 200)) == 2
 486     end
 487
 488     test "with default settings on private instances, returns 403 for unauthenticated users", %{
 489       conn: conn,
 490       base_uri: base_uri,
 491       error_response: error_response
 492     } do
 493       clear_config([:instance, :public], false)
 494       clear_config([:restrict_unauthenticated, :timelines])
 495
 496       for local <- [true, false] do
 497         res_conn = get(conn, "#{base_uri}?local=#{local}")
 498
 499         assert json_response(res_conn, :unauthorized) == error_response
 500       end
 501
 502       ensure_authenticated_access(base_uri)
 503     end
 504
 505     test "with `%{local: true, federated: true}`, returns 403 for unauthenticated users", %{
 506       conn: conn,
 507       base_uri: base_uri,
 508       error_response: error_response
 509     } do
 510       clear_config([:restrict_unauthenticated, :timelines, :local], true)
 511       clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 512
 513       for local <- [true, false] do
 514         res_conn = get(conn, "#{base_uri}?local=#{local}")
 515
 516         assert json_response(res_conn, :unauthorized) == error_response
 517       end
 518
 519       ensure_authenticated_access(base_uri)
 520     end
 521
 522     test "with `%{local: false, federated: true}`, forbids unauthenticated access to federated timeline",
 523          %{conn: conn, base_uri: base_uri, error_response: error_response} do
 524       clear_config([:restrict_unauthenticated, :timelines, :local], false)
 525       clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 526
 527       res_conn = get(conn, "#{base_uri}?local=true")
 528       assert length(json_response(res_conn, 200)) == 1
 529
 530       res_conn = get(conn, "#{base_uri}?local=false")
 531       assert json_response(res_conn, :unauthorized) == error_response
 532
 533       ensure_authenticated_access(base_uri)
 534     end
 535
 536     test "with `%{local: true, federated: false}`, forbids unauthenticated access to public timeline" <>
 537            "(but not to local public activities which are delivered as part of federated timeline)",
 538          %{conn: conn, base_uri: base_uri, error_response: error_response} do
 539       clear_config([:restrict_unauthenticated, :timelines, :local], true)
 540       clear_config([:restrict_unauthenticated, :timelines, :federated], false)
 541
 542       res_conn = get(conn, "#{base_uri}?local=true")
 543       assert json_response(res_conn, :unauthorized) == error_response
 544
 545       # Note: local activities get delivered as part of federated timeline
 546       res_conn = get(conn, "#{base_uri}?local=false")
 547       assert length(json_response(res_conn, 200)) == 2
 548
 549       ensure_authenticated_access(base_uri)
 550     end
 551   end
 552 end