git.squeep.com Git - akkoma/blob - test/web/mastodon_api/controllers/timeline_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.TimelineControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   import Pleroma.Factory
   9   import Tesla.Mock
  10
  11   alias Pleroma.Config
  12   alias Pleroma.User
  13   alias Pleroma.Web.CommonAPI
  14
  15   setup do
  16     mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
  17     :ok
  18   end
  19
  20   describe "home" do
  21     setup do: oauth_access(["read:statuses"])
  22
  23     test "does NOT render account/pleroma/relationship if this is disabled by default", %{
  24       user: user,
  25       conn: conn
  26     } do
  27       clear_config([:extensions, :output_relationships_in_statuses_by_default], false)
  28
  29       other_user = insert(:user)
  30
  31       {:ok, _} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})
  32
  33       response =
  34         conn
  35         |> assign(:user, user)
  36         |> get("/api/v1/timelines/home")
  37         |> json_response(200)
  38
  39       assert Enum.all?(response, fn n ->
  40                get_in(n, ["account", "pleroma", "relationship"]) == %{}
  41              end)
  42     end
  43
  44     test "the home timeline", %{user: user, conn: conn} do
  45       uri = "/api/v1/timelines/home?with_relationships=true"
  46
  47       following = insert(:user, nickname: "followed")
  48       third_user = insert(:user, nickname: "repeated")
  49
  50       {:ok, _activity} = CommonAPI.post(following, %{status: "post"})
  51       {:ok, activity} = CommonAPI.post(third_user, %{status: "repeated post"})
  52       {:ok, _, _} = CommonAPI.repeat(activity.id, following)
  53
  54       ret_conn = get(conn, uri)
  55
  56       assert Enum.empty?(json_response(ret_conn, :ok))
  57
  58       {:ok, _user} = User.follow(user, following)
  59
  60       ret_conn = get(conn, uri)
  61
  62       assert [
  63                %{
  64                  "reblog" => %{
  65                    "content" => "repeated post",
  66                    "account" => %{
  67                      "pleroma" => %{
  68                        "relationship" => %{"following" => false, "followed_by" => false}
  69                      }
  70                    }
  71                  },
  72                  "account" => %{"pleroma" => %{"relationship" => %{"following" => true}}}
  73                },
  74                %{
  75                  "content" => "post",
  76                  "account" => %{
  77                    "acct" => "followed",
  78                    "pleroma" => %{"relationship" => %{"following" => true}}
  79                  }
  80                }
  81              ] = json_response(ret_conn, :ok)
  82
  83       {:ok, _user} = User.follow(third_user, user)
  84
  85       ret_conn = get(conn, uri)
  86
  87       assert [
  88                %{
  89                  "reblog" => %{
  90                    "content" => "repeated post",
  91                    "account" => %{
  92                      "acct" => "repeated",
  93                      "pleroma" => %{
  94                        "relationship" => %{"following" => false, "followed_by" => true}
  95                      }
  96                    }
  97                  },
  98                  "account" => %{"pleroma" => %{"relationship" => %{"following" => true}}}
  99                },
 100                %{
 101                  "content" => "post",
 102                  "account" => %{
 103                    "acct" => "followed",
 104                    "pleroma" => %{"relationship" => %{"following" => true}}
 105                  }
 106                }
 107              ] = json_response(ret_conn, :ok)
 108     end
 109
 110     test "the home timeline when the direct messages are excluded", %{user: user, conn: conn} do
 111       {:ok, public_activity} = CommonAPI.post(user, %{status: ".", visibility: "public"})
 112       {:ok, direct_activity} = CommonAPI.post(user, %{status: ".", visibility: "direct"})
 113
 114       {:ok, unlisted_activity} = CommonAPI.post(user, %{status: ".", visibility: "unlisted"})
 115
 116       {:ok, private_activity} = CommonAPI.post(user, %{status: ".", visibility: "private"})
 117
 118       conn = get(conn, "/api/v1/timelines/home", %{"exclude_visibilities" => ["direct"]})
 119
 120       assert status_ids = json_response(conn, :ok) |> Enum.map(& &1["id"])
 121       assert public_activity.id in status_ids
 122       assert unlisted_activity.id in status_ids
 123       assert private_activity.id in status_ids
 124       refute direct_activity.id in status_ids
 125     end
 126   end
 127
 128   describe "public" do
 129     @tag capture_log: true
 130     test "the public timeline", %{conn: conn} do
 131       following = insert(:user)
 132
 133       {:ok, _activity} = CommonAPI.post(following, %{status: "test"})
 134
 135       _activity = insert(:note_activity, local: false)
 136
 137       conn = get(conn, "/api/v1/timelines/public", %{"local" => "False"})
 138
 139       assert length(json_response(conn, :ok)) == 2
 140
 141       conn = get(build_conn(), "/api/v1/timelines/public", %{"local" => "True"})
 142
 143       assert [%{"content" => "test"}] = json_response(conn, :ok)
 144
 145       conn = get(build_conn(), "/api/v1/timelines/public", %{"local" => "1"})
 146
 147       assert [%{"content" => "test"}] = json_response(conn, :ok)
 148     end
 149
 150     test "the public timeline includes only public statuses for an authenticated user" do
 151       %{user: user, conn: conn} = oauth_access(["read:statuses"])
 152
 153       {:ok, _activity} = CommonAPI.post(user, %{status: "test"})
 154       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "private"})
 155       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "unlisted"})
 156       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "direct"})
 157
 158       res_conn = get(conn, "/api/v1/timelines/public")
 159       assert length(json_response(res_conn, 200)) == 1
 160     end
 161   end
 162
 163   defp local_and_remote_activities do
 164     insert(:note_activity)
 165     insert(:note_activity, local: false)
 166     :ok
 167   end
 168
 169   describe "public with restrict unauthenticated timeline for local and federated timelines" do
 170     setup do: local_and_remote_activities()
 171
 172     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 173
 174     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 175
 176     test "if user is unauthenticated", %{conn: conn} do
 177       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 178
 179       assert json_response(res_conn, :unauthorized) == %{
 180                "error" => "authorization required for timeline view"
 181              }
 182
 183       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 184
 185       assert json_response(res_conn, :unauthorized) == %{
 186                "error" => "authorization required for timeline view"
 187              }
 188     end
 189
 190     test "if user is authenticated" do
 191       %{conn: conn} = oauth_access(["read:statuses"])
 192
 193       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 194       assert length(json_response(res_conn, 200)) == 1
 195
 196       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 197       assert length(json_response(res_conn, 200)) == 2
 198     end
 199   end
 200
 201   describe "public with restrict unauthenticated timeline for local" do
 202     setup do: local_and_remote_activities()
 203
 204     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 205
 206     test "if user is unauthenticated", %{conn: conn} do
 207       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 208
 209       assert json_response(res_conn, :unauthorized) == %{
 210                "error" => "authorization required for timeline view"
 211              }
 212
 213       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 214       assert length(json_response(res_conn, 200)) == 2
 215     end
 216
 217     test "if user is authenticated", %{conn: _conn} do
 218       %{conn: conn} = oauth_access(["read:statuses"])
 219
 220       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 221       assert length(json_response(res_conn, 200)) == 1
 222
 223       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 224       assert length(json_response(res_conn, 200)) == 2
 225     end
 226   end
 227
 228   describe "public with restrict unauthenticated timeline for remote" do
 229     setup do: local_and_remote_activities()
 230
 231     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 232
 233     test "if user is unauthenticated", %{conn: conn} do
 234       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 235       assert length(json_response(res_conn, 200)) == 1
 236
 237       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 238
 239       assert json_response(res_conn, :unauthorized) == %{
 240                "error" => "authorization required for timeline view"
 241              }
 242     end
 243
 244     test "if user is authenticated", %{conn: _conn} do
 245       %{conn: conn} = oauth_access(["read:statuses"])
 246
 247       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 248       assert length(json_response(res_conn, 200)) == 1
 249
 250       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 251       assert length(json_response(res_conn, 200)) == 2
 252     end
 253   end
 254
 255   describe "direct" do
 256     test "direct timeline", %{conn: conn} do
 257       user_one = insert(:user)
 258       user_two = insert(:user)
 259
 260       {:ok, user_two} = User.follow(user_two, user_one)
 261
 262       {:ok, direct} =
 263         CommonAPI.post(user_one, %{
 264           status: "Hi @#{user_two.nickname}!",
 265           visibility: "direct"
 266         })
 267
 268       {:ok, _follower_only} =
 269         CommonAPI.post(user_one, %{
 270           status: "Hi @#{user_two.nickname}!",
 271           visibility: "private"
 272         })
 273
 274       conn_user_two =
 275         conn
 276         |> assign(:user, user_two)
 277         |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
 278
 279       # Only direct should be visible here
 280       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 281
 282       [status] = json_response(res_conn, :ok)
 283
 284       assert %{"visibility" => "direct"} = status
 285       assert status["url"] != direct.data["id"]
 286
 287       # User should be able to see their own direct message
 288       res_conn =
 289         build_conn()
 290         |> assign(:user, user_one)
 291         |> assign(:token, insert(:oauth_token, user: user_one, scopes: ["read:statuses"]))
 292         |> get("api/v1/timelines/direct")
 293
 294       [status] = json_response(res_conn, :ok)
 295
 296       assert %{"visibility" => "direct"} = status
 297
 298       # Both should be visible here
 299       res_conn = get(conn_user_two, "api/v1/timelines/home")
 300
 301       [_s1, _s2] = json_response(res_conn, :ok)
 302
 303       # Test pagination
 304       Enum.each(1..20, fn _ ->
 305         {:ok, _} =
 306           CommonAPI.post(user_one, %{
 307             status: "Hi @#{user_two.nickname}!",
 308             visibility: "direct"
 309           })
 310       end)
 311
 312       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 313
 314       statuses = json_response(res_conn, :ok)
 315       assert length(statuses) == 20
 316
 317       res_conn =
 318         get(conn_user_two, "api/v1/timelines/direct", %{max_id: List.last(statuses)["id"]})
 319
 320       [status] = json_response(res_conn, :ok)
 321
 322       assert status["url"] != direct.data["id"]
 323     end
 324
 325     test "doesn't include DMs from blocked users" do
 326       %{user: blocker, conn: conn} = oauth_access(["read:statuses"])
 327       blocked = insert(:user)
 328       other_user = insert(:user)
 329       {:ok, _user_relationship} = User.block(blocker, blocked)
 330
 331       {:ok, _blocked_direct} =
 332         CommonAPI.post(blocked, %{
 333           status: "Hi @#{blocker.nickname}!",
 334           visibility: "direct"
 335         })
 336
 337       {:ok, direct} =
 338         CommonAPI.post(other_user, %{
 339           status: "Hi @#{blocker.nickname}!",
 340           visibility: "direct"
 341         })
 342
 343       res_conn = get(conn, "api/v1/timelines/direct")
 344
 345       [status] = json_response(res_conn, :ok)
 346       assert status["id"] == direct.id
 347     end
 348   end
 349
 350   describe "list" do
 351     setup do: oauth_access(["read:lists"])
 352
 353     test "list timeline", %{user: user, conn: conn} do
 354       other_user = insert(:user)
 355       {:ok, _activity_one} = CommonAPI.post(user, %{status: "Marisa is cute."})
 356       {:ok, activity_two} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 357       {:ok, list} = Pleroma.List.create("name", user)
 358       {:ok, list} = Pleroma.List.follow(list, other_user)
 359
 360       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 361
 362       assert [%{"id" => id}] = json_response(conn, :ok)
 363
 364       assert id == to_string(activity_two.id)
 365     end
 366
 367     test "list timeline does not leak non-public statuses for unfollowed users", %{
 368       user: user,
 369       conn: conn
 370     } do
 371       other_user = insert(:user)
 372       {:ok, activity_one} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 373
 374       {:ok, _activity_two} =
 375         CommonAPI.post(other_user, %{
 376           status: "Marisa is cute.",
 377           visibility: "private"
 378         })
 379
 380       {:ok, list} = Pleroma.List.create("name", user)
 381       {:ok, list} = Pleroma.List.follow(list, other_user)
 382
 383       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 384
 385       assert [%{"id" => id}] = json_response(conn, :ok)
 386
 387       assert id == to_string(activity_one.id)
 388     end
 389   end
 390
 391   describe "hashtag" do
 392     setup do: oauth_access(["n/a"])
 393
 394     @tag capture_log: true
 395     test "hashtag timeline", %{conn: conn} do
 396       following = insert(:user)
 397
 398       {:ok, activity} = CommonAPI.post(following, %{status: "test #2hu"})
 399
 400       nconn = get(conn, "/api/v1/timelines/tag/2hu")
 401
 402       assert [%{"id" => id}] = json_response(nconn, :ok)
 403
 404       assert id == to_string(activity.id)
 405
 406       # works for different capitalization too
 407       nconn = get(conn, "/api/v1/timelines/tag/2HU")
 408
 409       assert [%{"id" => id}] = json_response(nconn, :ok)
 410
 411       assert id == to_string(activity.id)
 412     end
 413
 414     test "multi-hashtag timeline", %{conn: conn} do
 415       user = insert(:user)
 416
 417       {:ok, activity_test} = CommonAPI.post(user, %{status: "#test"})
 418       {:ok, activity_test1} = CommonAPI.post(user, %{status: "#test #test1"})
 419       {:ok, activity_none} = CommonAPI.post(user, %{status: "#test #none"})
 420
 421       any_test = get(conn, "/api/v1/timelines/tag/test", %{"any" => ["test1"]})
 422
 423       [status_none, status_test1, status_test] = json_response(any_test, :ok)
 424
 425       assert to_string(activity_test.id) == status_test["id"]
 426       assert to_string(activity_test1.id) == status_test1["id"]
 427       assert to_string(activity_none.id) == status_none["id"]
 428
 429       restricted_test =
 430         get(conn, "/api/v1/timelines/tag/test", %{"all" => ["test1"], "none" => ["none"]})
 431
 432       assert [status_test1] == json_response(restricted_test, :ok)
 433
 434       all_test = get(conn, "/api/v1/timelines/tag/test", %{"all" => ["none"]})
 435
 436       assert [status_none] == json_response(all_test, :ok)
 437     end
 438   end
 439 end