git.squeep.com Git - akkoma/blob - test/web/mastodon_api/controllers/timeline_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.TimelineControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   import Pleroma.Factory
   9   import Tesla.Mock
  10
  11   alias Pleroma.Config
  12   alias Pleroma.User
  13   alias Pleroma.Web.CommonAPI
  14
  15   setup do
  16     mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
  17     :ok
  18   end
  19
  20   describe "home" do
  21     setup do: oauth_access(["read:statuses"])
  22
  23     test "does NOT embed account/pleroma/relationship in statuses", %{
  24       user: user,
  25       conn: conn
  26     } do
  27       other_user = insert(:user)
  28
  29       {:ok, _} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})
  30
  31       response =
  32         conn
  33         |> assign(:user, user)
  34         |> get("/api/v1/timelines/home")
  35         |> json_response_and_validate_schema(200)
  36
  37       assert Enum.all?(response, fn n ->
  38                get_in(n, ["account", "pleroma", "relationship"]) == %{}
  39              end)
  40     end
  41
  42     test "the home timeline when the direct messages are excluded", %{user: user, conn: conn} do
  43       {:ok, public_activity} = CommonAPI.post(user, %{status: ".", visibility: "public"})
  44       {:ok, direct_activity} = CommonAPI.post(user, %{status: ".", visibility: "direct"})
  45
  46       {:ok, unlisted_activity} = CommonAPI.post(user, %{status: ".", visibility: "unlisted"})
  47
  48       {:ok, private_activity} = CommonAPI.post(user, %{status: ".", visibility: "private"})
  49
  50       conn = get(conn, "/api/v1/timelines/home?exclude_visibilities[]=direct")
  51
  52       assert status_ids = json_response_and_validate_schema(conn, :ok) |> Enum.map(& &1["id"])
  53       assert public_activity.id in status_ids
  54       assert unlisted_activity.id in status_ids
  55       assert private_activity.id in status_ids
  56       refute direct_activity.id in status_ids
  57     end
  58   end
  59
  60   describe "public" do
  61     @tag capture_log: true
  62     test "the public timeline", %{conn: conn} do
  63       following = insert(:user)
  64
  65       {:ok, _activity} = CommonAPI.post(following, %{status: "test"})
  66
  67       _activity = insert(:note_activity, local: false)
  68
  69       conn = get(conn, "/api/v1/timelines/public?local=False")
  70
  71       assert length(json_response_and_validate_schema(conn, :ok)) == 2
  72
  73       conn = get(build_conn(), "/api/v1/timelines/public?local=True")
  74
  75       assert [%{"content" => "test"}] = json_response_and_validate_schema(conn, :ok)
  76
  77       conn = get(build_conn(), "/api/v1/timelines/public?local=1")
  78
  79       assert [%{"content" => "test"}] = json_response_and_validate_schema(conn, :ok)
  80     end
  81
  82     test "the public timeline includes only public statuses for an authenticated user" do
  83       %{user: user, conn: conn} = oauth_access(["read:statuses"])
  84
  85       {:ok, _activity} = CommonAPI.post(user, %{status: "test"})
  86       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "private"})
  87       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "unlisted"})
  88       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "direct"})
  89
  90       res_conn = get(conn, "/api/v1/timelines/public")
  91       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
  92     end
  93   end
  94
  95   defp local_and_remote_activities do
  96     insert(:note_activity)
  97     insert(:note_activity, local: false)
  98     :ok
  99   end
 100
 101   describe "public with restrict unauthenticated timeline for local and federated timelines" do
 102     setup do: local_and_remote_activities()
 103
 104     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 105
 106     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 107
 108     test "if user is unauthenticated", %{conn: conn} do
 109       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 110
 111       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 112                "error" => "authorization required for timeline view"
 113              }
 114
 115       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 116
 117       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 118                "error" => "authorization required for timeline view"
 119              }
 120     end
 121
 122     test "if user is authenticated" do
 123       %{conn: conn} = oauth_access(["read:statuses"])
 124
 125       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 126       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 127
 128       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 129       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 130     end
 131   end
 132
 133   describe "public with restrict unauthenticated timeline for local" do
 134     setup do: local_and_remote_activities()
 135
 136     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 137
 138     test "if user is unauthenticated", %{conn: conn} do
 139       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 140
 141       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 142                "error" => "authorization required for timeline view"
 143              }
 144
 145       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 146       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 147     end
 148
 149     test "if user is authenticated", %{conn: _conn} do
 150       %{conn: conn} = oauth_access(["read:statuses"])
 151
 152       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 153       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 154
 155       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 156       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 157     end
 158   end
 159
 160   describe "public with restrict unauthenticated timeline for remote" do
 161     setup do: local_and_remote_activities()
 162
 163     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 164
 165     test "if user is unauthenticated", %{conn: conn} do
 166       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 167       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 168
 169       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 170
 171       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 172                "error" => "authorization required for timeline view"
 173              }
 174     end
 175
 176     test "if user is authenticated", %{conn: _conn} do
 177       %{conn: conn} = oauth_access(["read:statuses"])
 178
 179       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 180       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 181
 182       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 183       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 184     end
 185   end
 186
 187   describe "direct" do
 188     test "direct timeline", %{conn: conn} do
 189       user_one = insert(:user)
 190       user_two = insert(:user)
 191
 192       {:ok, user_two} = User.follow(user_two, user_one)
 193
 194       {:ok, direct} =
 195         CommonAPI.post(user_one, %{
 196           status: "Hi @#{user_two.nickname}!",
 197           visibility: "direct"
 198         })
 199
 200       {:ok, _follower_only} =
 201         CommonAPI.post(user_one, %{
 202           status: "Hi @#{user_two.nickname}!",
 203           visibility: "private"
 204         })
 205
 206       conn_user_two =
 207         conn
 208         |> assign(:user, user_two)
 209         |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
 210
 211       # Only direct should be visible here
 212       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 213
 214       assert [status] = json_response_and_validate_schema(res_conn, :ok)
 215
 216       assert %{"visibility" => "direct"} = status
 217       assert status["url"] != direct.data["id"]
 218
 219       # User should be able to see their own direct message
 220       res_conn =
 221         build_conn()
 222         |> assign(:user, user_one)
 223         |> assign(:token, insert(:oauth_token, user: user_one, scopes: ["read:statuses"]))
 224         |> get("api/v1/timelines/direct")
 225
 226       [status] = json_response_and_validate_schema(res_conn, :ok)
 227
 228       assert %{"visibility" => "direct"} = status
 229
 230       # Both should be visible here
 231       res_conn = get(conn_user_two, "api/v1/timelines/home")
 232
 233       [_s1, _s2] = json_response_and_validate_schema(res_conn, :ok)
 234
 235       # Test pagination
 236       Enum.each(1..20, fn _ ->
 237         {:ok, _} =
 238           CommonAPI.post(user_one, %{
 239             status: "Hi @#{user_two.nickname}!",
 240             visibility: "direct"
 241           })
 242       end)
 243
 244       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 245
 246       statuses = json_response_and_validate_schema(res_conn, :ok)
 247       assert length(statuses) == 20
 248
 249       max_id = List.last(statuses)["id"]
 250
 251       res_conn = get(conn_user_two, "api/v1/timelines/direct?max_id=#{max_id}")
 252
 253       assert [status] = json_response_and_validate_schema(res_conn, :ok)
 254
 255       assert status["url"] != direct.data["id"]
 256     end
 257
 258     test "doesn't include DMs from blocked users" do
 259       %{user: blocker, conn: conn} = oauth_access(["read:statuses"])
 260       blocked = insert(:user)
 261       other_user = insert(:user)
 262       {:ok, _user_relationship} = User.block(blocker, blocked)
 263
 264       {:ok, _blocked_direct} =
 265         CommonAPI.post(blocked, %{
 266           status: "Hi @#{blocker.nickname}!",
 267           visibility: "direct"
 268         })
 269
 270       {:ok, direct} =
 271         CommonAPI.post(other_user, %{
 272           status: "Hi @#{blocker.nickname}!",
 273           visibility: "direct"
 274         })
 275
 276       res_conn = get(conn, "api/v1/timelines/direct")
 277
 278       [status] = json_response_and_validate_schema(res_conn, :ok)
 279       assert status["id"] == direct.id
 280     end
 281   end
 282
 283   describe "list" do
 284     setup do: oauth_access(["read:lists"])
 285
 286     test "list timeline", %{user: user, conn: conn} do
 287       other_user = insert(:user)
 288       {:ok, _activity_one} = CommonAPI.post(user, %{status: "Marisa is cute."})
 289       {:ok, activity_two} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 290       {:ok, list} = Pleroma.List.create("name", user)
 291       {:ok, list} = Pleroma.List.follow(list, other_user)
 292
 293       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 294
 295       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 296
 297       assert id == to_string(activity_two.id)
 298     end
 299
 300     test "list timeline does not leak non-public statuses for unfollowed users", %{
 301       user: user,
 302       conn: conn
 303     } do
 304       other_user = insert(:user)
 305       {:ok, activity_one} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 306
 307       {:ok, _activity_two} =
 308         CommonAPI.post(other_user, %{
 309           status: "Marisa is cute.",
 310           visibility: "private"
 311         })
 312
 313       {:ok, list} = Pleroma.List.create("name", user)
 314       {:ok, list} = Pleroma.List.follow(list, other_user)
 315
 316       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 317
 318       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 319
 320       assert id == to_string(activity_one.id)
 321     end
 322   end
 323
 324   describe "hashtag" do
 325     setup do: oauth_access(["n/a"])
 326
 327     @tag capture_log: true
 328     test "hashtag timeline", %{conn: conn} do
 329       following = insert(:user)
 330
 331       {:ok, activity} = CommonAPI.post(following, %{status: "test #2hu"})
 332
 333       nconn = get(conn, "/api/v1/timelines/tag/2hu")
 334
 335       assert [%{"id" => id}] = json_response_and_validate_schema(nconn, :ok)
 336
 337       assert id == to_string(activity.id)
 338
 339       # works for different capitalization too
 340       nconn = get(conn, "/api/v1/timelines/tag/2HU")
 341
 342       assert [%{"id" => id}] = json_response_and_validate_schema(nconn, :ok)
 343
 344       assert id == to_string(activity.id)
 345     end
 346
 347     test "multi-hashtag timeline", %{conn: conn} do
 348       user = insert(:user)
 349
 350       {:ok, activity_test} = CommonAPI.post(user, %{status: "#test"})
 351       {:ok, activity_test1} = CommonAPI.post(user, %{status: "#test #test1"})
 352       {:ok, activity_none} = CommonAPI.post(user, %{status: "#test #none"})
 353
 354       any_test = get(conn, "/api/v1/timelines/tag/test?any[]=test1")
 355
 356       [status_none, status_test1, status_test] = json_response_and_validate_schema(any_test, :ok)
 357
 358       assert to_string(activity_test.id) == status_test["id"]
 359       assert to_string(activity_test1.id) == status_test1["id"]
 360       assert to_string(activity_none.id) == status_none["id"]
 361
 362       restricted_test = get(conn, "/api/v1/timelines/tag/test?all[]=test1&none[]=none")
 363
 364       assert [status_test1] == json_response_and_validate_schema(restricted_test, :ok)
 365
 366       all_test = get(conn, "/api/v1/timelines/tag/test?all[]=none")
 367
 368       assert [status_none] == json_response_and_validate_schema(all_test, :ok)
 369     end
 370   end
 371 end