git.squeep.com Git - akkoma/blob - test/web/mastodon_api/controllers/timeline_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.TimelineControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   import Pleroma.Factory
   9   import Tesla.Mock
  10
  11   alias Pleroma.Config
  12   alias Pleroma.User
  13   alias Pleroma.Web.CommonAPI
  14
  15   setup do
  16     mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
  17     :ok
  18   end
  19
  20   describe "home" do
  21     setup do: oauth_access(["read:statuses"])
  22
  23     test "does NOT embed account/pleroma/relationship in statuses", %{
  24       user: user,
  25       conn: conn
  26     } do
  27       other_user = insert(:user)
  28
  29       {:ok, _} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})
  30
  31       response =
  32         conn
  33         |> assign(:user, user)
  34         |> get("/api/v1/timelines/home")
  35         |> json_response_and_validate_schema(200)
  36
  37       assert Enum.all?(response, fn n ->
  38                get_in(n, ["account", "pleroma", "relationship"]) == %{}
  39              end)
  40     end
  41
  42     test "the home timeline when the direct messages are excluded", %{user: user, conn: conn} do
  43       {:ok, public_activity} = CommonAPI.post(user, %{status: ".", visibility: "public"})
  44       {:ok, direct_activity} = CommonAPI.post(user, %{status: ".", visibility: "direct"})
  45
  46       {:ok, unlisted_activity} = CommonAPI.post(user, %{status: ".", visibility: "unlisted"})
  47
  48       {:ok, private_activity} = CommonAPI.post(user, %{status: ".", visibility: "private"})
  49
  50       conn = get(conn, "/api/v1/timelines/home?exclude_visibilities[]=direct")
  51
  52       assert status_ids = json_response_and_validate_schema(conn, :ok) |> Enum.map(& &1["id"])
  53       assert public_activity.id in status_ids
  54       assert unlisted_activity.id in status_ids
  55       assert private_activity.id in status_ids
  56       refute direct_activity.id in status_ids
  57     end
  58   end
  59
  60   describe "public" do
  61     @tag capture_log: true
  62     test "the public timeline", %{conn: conn} do
  63       user = insert(:user)
  64
  65       {:ok, activity} = CommonAPI.post(user, %{status: "test"})
  66
  67       _activity = insert(:note_activity, local: false)
  68
  69       conn = get(conn, "/api/v1/timelines/public?local=False")
  70
  71       assert length(json_response_and_validate_schema(conn, :ok)) == 2
  72
  73       conn = get(build_conn(), "/api/v1/timelines/public?local=True")
  74
  75       assert [%{"content" => "test"}] = json_response_and_validate_schema(conn, :ok)
  76
  77       conn = get(build_conn(), "/api/v1/timelines/public?local=1")
  78
  79       assert [%{"content" => "test"}] = json_response_and_validate_schema(conn, :ok)
  80
  81       # does not contain repeats
  82       {:ok, _} = CommonAPI.repeat(activity.id, user)
  83
  84       conn = get(build_conn(), "/api/v1/timelines/public?local=true")
  85
  86       assert [_] = json_response_and_validate_schema(conn, :ok)
  87     end
  88
  89     test "the public timeline includes only public statuses for an authenticated user" do
  90       %{user: user, conn: conn} = oauth_access(["read:statuses"])
  91
  92       {:ok, _activity} = CommonAPI.post(user, %{status: "test"})
  93       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "private"})
  94       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "unlisted"})
  95       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "direct"})
  96
  97       res_conn = get(conn, "/api/v1/timelines/public")
  98       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
  99     end
 100
 101     test "doesn't return replies if follower is posting with blocked user" do
 102       %{conn: conn, user: blocker} = oauth_access(["read:statuses"])
 103       [blockee, friend] = insert_list(2, :user)
 104       {:ok, blocker} = User.follow(blocker, friend)
 105       {:ok, _} = User.block(blocker, blockee)
 106
 107       conn = assign(conn, :user, blocker)
 108
 109       {:ok, %{id: activity_id} = activity} = CommonAPI.post(friend, %{status: "hey!"})
 110
 111       {:ok, reply_from_blockee} =
 112         CommonAPI.post(blockee, %{status: "heya", in_reply_to_status_id: activity})
 113
 114       {:ok, _reply_from_friend} =
 115         CommonAPI.post(friend, %{status: "status", in_reply_to_status_id: reply_from_blockee})
 116
 117       res_conn = get(conn, "/api/v1/timelines/public")
 118       [%{"id" => ^activity_id}] = json_response_and_validate_schema(res_conn, 200)
 119     end
 120
 121     test "doesn't return replies if follow is posting with users from blocked domain" do
 122       %{conn: conn, user: blocker} = oauth_access(["read:statuses"])
 123       friend = insert(:user)
 124       blockee = insert(:user, ap_id: "https://example.com/users/blocked")
 125       {:ok, blocker} = User.follow(blocker, friend)
 126       {:ok, blocker} = User.block_domain(blocker, "example.com")
 127
 128       conn = assign(conn, :user, blocker)
 129
 130       {:ok, %{id: activity_id} = activity} = CommonAPI.post(friend, %{status: "hey!"})
 131
 132       {:ok, reply_from_blockee} =
 133         CommonAPI.post(blockee, %{status: "heya", in_reply_to_status_id: activity})
 134
 135       {:ok, _reply_from_friend} =
 136         CommonAPI.post(friend, %{status: "status", in_reply_to_status_id: reply_from_blockee})
 137
 138       res_conn = get(conn, "/api/v1/timelines/public")
 139
 140       activities = json_response_and_validate_schema(res_conn, 200)
 141       [%{"id" => ^activity_id}] = activities
 142     end
 143   end
 144
 145   defp local_and_remote_activities do
 146     insert(:note_activity)
 147     insert(:note_activity, local: false)
 148     :ok
 149   end
 150
 151   describe "public with restrict unauthenticated timeline for local and federated timelines" do
 152     setup do: local_and_remote_activities()
 153
 154     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 155
 156     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 157
 158     test "if user is unauthenticated", %{conn: conn} do
 159       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 160
 161       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 162                "error" => "authorization required for timeline view"
 163              }
 164
 165       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 166
 167       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 168                "error" => "authorization required for timeline view"
 169              }
 170     end
 171
 172     test "if user is authenticated" do
 173       %{conn: conn} = oauth_access(["read:statuses"])
 174
 175       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 176       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 177
 178       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 179       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 180     end
 181   end
 182
 183   describe "public with restrict unauthenticated timeline for local" do
 184     setup do: local_and_remote_activities()
 185
 186     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 187
 188     test "if user is unauthenticated", %{conn: conn} do
 189       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 190
 191       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 192                "error" => "authorization required for timeline view"
 193              }
 194
 195       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 196       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 197     end
 198
 199     test "if user is authenticated", %{conn: _conn} do
 200       %{conn: conn} = oauth_access(["read:statuses"])
 201
 202       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 203       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 204
 205       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 206       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 207     end
 208   end
 209
 210   describe "public with restrict unauthenticated timeline for remote" do
 211     setup do: local_and_remote_activities()
 212
 213     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 214
 215     test "if user is unauthenticated", %{conn: conn} do
 216       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 217       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 218
 219       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 220
 221       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 222                "error" => "authorization required for timeline view"
 223              }
 224     end
 225
 226     test "if user is authenticated", %{conn: _conn} do
 227       %{conn: conn} = oauth_access(["read:statuses"])
 228
 229       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 230       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 231
 232       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 233       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 234     end
 235   end
 236
 237   describe "direct" do
 238     test "direct timeline", %{conn: conn} do
 239       user_one = insert(:user)
 240       user_two = insert(:user)
 241
 242       {:ok, user_two} = User.follow(user_two, user_one)
 243
 244       {:ok, direct} =
 245         CommonAPI.post(user_one, %{
 246           status: "Hi @#{user_two.nickname}!",
 247           visibility: "direct"
 248         })
 249
 250       {:ok, _follower_only} =
 251         CommonAPI.post(user_one, %{
 252           status: "Hi @#{user_two.nickname}!",
 253           visibility: "private"
 254         })
 255
 256       conn_user_two =
 257         conn
 258         |> assign(:user, user_two)
 259         |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
 260
 261       # Only direct should be visible here
 262       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 263
 264       assert [status] = json_response_and_validate_schema(res_conn, :ok)
 265
 266       assert %{"visibility" => "direct"} = status
 267       assert status["url"] != direct.data["id"]
 268
 269       # User should be able to see their own direct message
 270       res_conn =
 271         build_conn()
 272         |> assign(:user, user_one)
 273         |> assign(:token, insert(:oauth_token, user: user_one, scopes: ["read:statuses"]))
 274         |> get("api/v1/timelines/direct")
 275
 276       [status] = json_response_and_validate_schema(res_conn, :ok)
 277
 278       assert %{"visibility" => "direct"} = status
 279
 280       # Both should be visible here
 281       res_conn = get(conn_user_two, "api/v1/timelines/home")
 282
 283       [_s1, _s2] = json_response_and_validate_schema(res_conn, :ok)
 284
 285       # Test pagination
 286       Enum.each(1..20, fn _ ->
 287         {:ok, _} =
 288           CommonAPI.post(user_one, %{
 289             status: "Hi @#{user_two.nickname}!",
 290             visibility: "direct"
 291           })
 292       end)
 293
 294       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 295
 296       statuses = json_response_and_validate_schema(res_conn, :ok)
 297       assert length(statuses) == 20
 298
 299       max_id = List.last(statuses)["id"]
 300
 301       res_conn = get(conn_user_two, "api/v1/timelines/direct?max_id=#{max_id}")
 302
 303       assert [status] = json_response_and_validate_schema(res_conn, :ok)
 304
 305       assert status["url"] != direct.data["id"]
 306     end
 307
 308     test "doesn't include DMs from blocked users" do
 309       %{user: blocker, conn: conn} = oauth_access(["read:statuses"])
 310       blocked = insert(:user)
 311       other_user = insert(:user)
 312       {:ok, _user_relationship} = User.block(blocker, blocked)
 313
 314       {:ok, _blocked_direct} =
 315         CommonAPI.post(blocked, %{
 316           status: "Hi @#{blocker.nickname}!",
 317           visibility: "direct"
 318         })
 319
 320       {:ok, direct} =
 321         CommonAPI.post(other_user, %{
 322           status: "Hi @#{blocker.nickname}!",
 323           visibility: "direct"
 324         })
 325
 326       res_conn = get(conn, "api/v1/timelines/direct")
 327
 328       [status] = json_response_and_validate_schema(res_conn, :ok)
 329       assert status["id"] == direct.id
 330     end
 331   end
 332
 333   describe "list" do
 334     setup do: oauth_access(["read:lists"])
 335
 336     test "list timeline", %{user: user, conn: conn} do
 337       other_user = insert(:user)
 338       {:ok, _activity_one} = CommonAPI.post(user, %{status: "Marisa is cute."})
 339       {:ok, activity_two} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 340       {:ok, list} = Pleroma.List.create("name", user)
 341       {:ok, list} = Pleroma.List.follow(list, other_user)
 342
 343       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 344
 345       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 346
 347       assert id == to_string(activity_two.id)
 348     end
 349
 350     test "list timeline does not leak non-public statuses for unfollowed users", %{
 351       user: user,
 352       conn: conn
 353     } do
 354       other_user = insert(:user)
 355       {:ok, activity_one} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 356
 357       {:ok, _activity_two} =
 358         CommonAPI.post(other_user, %{
 359           status: "Marisa is cute.",
 360           visibility: "private"
 361         })
 362
 363       {:ok, list} = Pleroma.List.create("name", user)
 364       {:ok, list} = Pleroma.List.follow(list, other_user)
 365
 366       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 367
 368       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 369
 370       assert id == to_string(activity_one.id)
 371     end
 372   end
 373
 374   describe "hashtag" do
 375     setup do: oauth_access(["n/a"])
 376
 377     @tag capture_log: true
 378     test "hashtag timeline", %{conn: conn} do
 379       following = insert(:user)
 380
 381       {:ok, activity} = CommonAPI.post(following, %{status: "test #2hu"})
 382
 383       nconn = get(conn, "/api/v1/timelines/tag/2hu")
 384
 385       assert [%{"id" => id}] = json_response_and_validate_schema(nconn, :ok)
 386
 387       assert id == to_string(activity.id)
 388
 389       # works for different capitalization too
 390       nconn = get(conn, "/api/v1/timelines/tag/2HU")
 391
 392       assert [%{"id" => id}] = json_response_and_validate_schema(nconn, :ok)
 393
 394       assert id == to_string(activity.id)
 395     end
 396
 397     test "multi-hashtag timeline", %{conn: conn} do
 398       user = insert(:user)
 399
 400       {:ok, activity_test} = CommonAPI.post(user, %{status: "#test"})
 401       {:ok, activity_test1} = CommonAPI.post(user, %{status: "#test #test1"})
 402       {:ok, activity_none} = CommonAPI.post(user, %{status: "#test #none"})
 403
 404       any_test = get(conn, "/api/v1/timelines/tag/test?any[]=test1")
 405
 406       [status_none, status_test1, status_test] = json_response_and_validate_schema(any_test, :ok)
 407
 408       assert to_string(activity_test.id) == status_test["id"]
 409       assert to_string(activity_test1.id) == status_test1["id"]
 410       assert to_string(activity_none.id) == status_none["id"]
 411
 412       restricted_test = get(conn, "/api/v1/timelines/tag/test?all[]=test1&none[]=none")
 413
 414       assert [status_test1] == json_response_and_validate_schema(restricted_test, :ok)
 415
 416       all_test = get(conn, "/api/v1/timelines/tag/test?all[]=none")
 417
 418       assert [status_none] == json_response_and_validate_schema(all_test, :ok)
 419     end
 420   end
 421
 422   describe "hashtag timeline handling of :restrict_unauthenticated setting" do
 423     setup do
 424       user = insert(:user)
 425       {:ok, activity1} = CommonAPI.post(user, %{status: "test #tag1"})
 426       {:ok, _activity2} = CommonAPI.post(user, %{status: "test #tag1"})
 427
 428       activity1
 429       |> Ecto.Changeset.change(%{local: false})
 430       |> Pleroma.Repo.update()
 431
 432       base_uri = "/api/v1/timelines/tag/tag1"
 433       error_response = %{"error" => "authorization required for timeline view"}
 434
 435       %{base_uri: base_uri, error_response: error_response}
 436     end
 437
 438     defp ensure_authenticated_access(base_uri) do
 439       %{conn: auth_conn} = oauth_access(["read:statuses"])
 440
 441       res_conn = get(auth_conn, "#{base_uri}?local=true")
 442       assert length(json_response(res_conn, 200)) == 1
 443
 444       res_conn = get(auth_conn, "#{base_uri}?local=false")
 445       assert length(json_response(res_conn, 200)) == 2
 446     end
 447
 448     test "with `%{local: true, federated: true}`, returns 403 for unauthenticated users", %{
 449       conn: conn,
 450       base_uri: base_uri,
 451       error_response: error_response
 452     } do
 453       clear_config([:restrict_unauthenticated, :timelines, :local], true)
 454       clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 455
 456       for local <- [true, false] do
 457         res_conn = get(conn, "#{base_uri}?local=#{local}")
 458
 459         assert json_response(res_conn, :unauthorized) == error_response
 460       end
 461
 462       ensure_authenticated_access(base_uri)
 463     end
 464
 465     test "with `%{local: false, federated: true}`, forbids unauthenticated access to federated timeline",
 466          %{conn: conn, base_uri: base_uri, error_response: error_response} do
 467       clear_config([:restrict_unauthenticated, :timelines, :local], false)
 468       clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 469
 470       res_conn = get(conn, "#{base_uri}?local=true")
 471       assert length(json_response(res_conn, 200)) == 1
 472
 473       res_conn = get(conn, "#{base_uri}?local=false")
 474       assert json_response(res_conn, :unauthorized) == error_response
 475
 476       ensure_authenticated_access(base_uri)
 477     end
 478
 479     test "with `%{local: true, federated: false}`, forbids unauthenticated access to public timeline" <>
 480            "(but not to local public activities which are delivered as part of federated timeline)",
 481          %{conn: conn, base_uri: base_uri, error_response: error_response} do
 482       clear_config([:restrict_unauthenticated, :timelines, :local], true)
 483       clear_config([:restrict_unauthenticated, :timelines, :federated], false)
 484
 485       res_conn = get(conn, "#{base_uri}?local=true")
 486       assert json_response(res_conn, :unauthorized) == error_response
 487
 488       # Note: local activities get delivered as part of federated timeline
 489       res_conn = get(conn, "#{base_uri}?local=false")
 490       assert length(json_response(res_conn, 200)) == 2
 491
 492       ensure_authenticated_access(base_uri)
 493     end
 494   end
 495 end