git.squeep.com Git - akkoma/blob - test/web/mastodon_api/controllers/timeline_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.TimelineControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   import Pleroma.Factory
   9   import Tesla.Mock
  10
  11   alias Pleroma.Config
  12   alias Pleroma.User
  13   alias Pleroma.Web.CommonAPI
  14
  15   setup do
  16     mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
  17     :ok
  18   end
  19
  20   describe "home" do
  21     setup do: oauth_access(["read:statuses"])
  22
  23     test "does NOT render account/pleroma/relationship if this is disabled by default", %{
  24       user: user,
  25       conn: conn
  26     } do
  27       clear_config([:extensions, :output_relationships_in_statuses_by_default], false)
  28
  29       other_user = insert(:user)
  30
  31       {:ok, _} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})
  32
  33       response =
  34         conn
  35         |> assign(:user, user)
  36         |> get("/api/v1/timelines/home")
  37         |> json_response_and_validate_schema(200)
  38
  39       assert Enum.all?(response, fn n ->
  40                get_in(n, ["account", "pleroma", "relationship"]) == %{}
  41              end)
  42     end
  43
  44     test "the home timeline", %{user: user, conn: conn} do
  45       uri = "/api/v1/timelines/home?with_relationships=1"
  46
  47       following = insert(:user, nickname: "followed")
  48       third_user = insert(:user, nickname: "repeated")
  49
  50       {:ok, _activity} = CommonAPI.post(following, %{status: "post"})
  51       {:ok, activity} = CommonAPI.post(third_user, %{status: "repeated post"})
  52       {:ok, _, _} = CommonAPI.repeat(activity.id, following)
  53
  54       ret_conn = get(conn, uri)
  55
  56       assert Enum.empty?(json_response_and_validate_schema(ret_conn, :ok))
  57
  58       {:ok, _user} = User.follow(user, following)
  59
  60       ret_conn = get(conn, uri)
  61
  62       assert [
  63                %{
  64                  "reblog" => %{
  65                    "content" => "repeated post",
  66                    "account" => %{
  67                      "pleroma" => %{
  68                        "relationship" => %{"following" => false, "followed_by" => false}
  69                      }
  70                    }
  71                  },
  72                  "account" => %{"pleroma" => %{"relationship" => %{"following" => true}}}
  73                },
  74                %{
  75                  "content" => "post",
  76                  "account" => %{
  77                    "acct" => "followed",
  78                    "pleroma" => %{"relationship" => %{"following" => true}}
  79                  }
  80                }
  81              ] = json_response_and_validate_schema(ret_conn, :ok)
  82
  83       {:ok, _user} = User.follow(third_user, user)
  84
  85       ret_conn = get(conn, uri)
  86
  87       assert [
  88                %{
  89                  "reblog" => %{
  90                    "content" => "repeated post",
  91                    "account" => %{
  92                      "acct" => "repeated",
  93                      "pleroma" => %{
  94                        "relationship" => %{"following" => false, "followed_by" => true}
  95                      }
  96                    }
  97                  },
  98                  "account" => %{"pleroma" => %{"relationship" => %{"following" => true}}}
  99                },
 100                %{
 101                  "content" => "post",
 102                  "account" => %{
 103                    "acct" => "followed",
 104                    "pleroma" => %{"relationship" => %{"following" => true}}
 105                  }
 106                }
 107              ] = json_response_and_validate_schema(ret_conn, :ok)
 108     end
 109
 110     test "the home timeline when the direct messages are excluded", %{user: user, conn: conn} do
 111       {:ok, public_activity} = CommonAPI.post(user, %{status: ".", visibility: "public"})
 112       {:ok, direct_activity} = CommonAPI.post(user, %{status: ".", visibility: "direct"})
 113
 114       {:ok, unlisted_activity} = CommonAPI.post(user, %{status: ".", visibility: "unlisted"})
 115
 116       {:ok, private_activity} = CommonAPI.post(user, %{status: ".", visibility: "private"})
 117
 118       conn = get(conn, "/api/v1/timelines/home?exclude_visibilities[]=direct")
 119
 120       assert status_ids = json_response_and_validate_schema(conn, :ok) |> Enum.map(& &1["id"])
 121       assert public_activity.id in status_ids
 122       assert unlisted_activity.id in status_ids
 123       assert private_activity.id in status_ids
 124       refute direct_activity.id in status_ids
 125     end
 126   end
 127
 128   describe "public" do
 129     @tag capture_log: true
 130     test "the public timeline", %{conn: conn} do
 131       following = insert(:user)
 132
 133       {:ok, _activity} = CommonAPI.post(following, %{status: "test"})
 134
 135       _activity = insert(:note_activity, local: false)
 136
 137       conn = get(conn, "/api/v1/timelines/public?local=False")
 138
 139       assert length(json_response_and_validate_schema(conn, :ok)) == 2
 140
 141       conn = get(build_conn(), "/api/v1/timelines/public?local=True")
 142
 143       assert [%{"content" => "test"}] = json_response_and_validate_schema(conn, :ok)
 144
 145       conn = get(build_conn(), "/api/v1/timelines/public?local=1")
 146
 147       assert [%{"content" => "test"}] = json_response_and_validate_schema(conn, :ok)
 148     end
 149
 150     test "the public timeline includes only public statuses for an authenticated user" do
 151       %{user: user, conn: conn} = oauth_access(["read:statuses"])
 152
 153       {:ok, _activity} = CommonAPI.post(user, %{status: "test"})
 154       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "private"})
 155       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "unlisted"})
 156       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "direct"})
 157
 158       res_conn = get(conn, "/api/v1/timelines/public")
 159       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 160     end
 161   end
 162
 163   defp local_and_remote_activities do
 164     insert(:note_activity)
 165     insert(:note_activity, local: false)
 166     :ok
 167   end
 168
 169   describe "public with restrict unauthenticated timeline for local and federated timelines" do
 170     setup do: local_and_remote_activities()
 171
 172     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 173
 174     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 175
 176     test "if user is unauthenticated", %{conn: conn} do
 177       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 178
 179       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 180                "error" => "authorization required for timeline view"
 181              }
 182
 183       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 184
 185       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 186                "error" => "authorization required for timeline view"
 187              }
 188     end
 189
 190     test "if user is authenticated" do
 191       %{conn: conn} = oauth_access(["read:statuses"])
 192
 193       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 194       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 195
 196       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 197       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 198     end
 199   end
 200
 201   describe "public with restrict unauthenticated timeline for local" do
 202     setup do: local_and_remote_activities()
 203
 204     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 205
 206     test "if user is unauthenticated", %{conn: conn} do
 207       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 208
 209       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 210                "error" => "authorization required for timeline view"
 211              }
 212
 213       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 214       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 215     end
 216
 217     test "if user is authenticated", %{conn: _conn} do
 218       %{conn: conn} = oauth_access(["read:statuses"])
 219
 220       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 221       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 222
 223       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 224       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 225     end
 226   end
 227
 228   describe "public with restrict unauthenticated timeline for remote" do
 229     setup do: local_and_remote_activities()
 230
 231     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 232
 233     test "if user is unauthenticated", %{conn: conn} do
 234       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 235       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 236
 237       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 238
 239       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 240                "error" => "authorization required for timeline view"
 241              }
 242     end
 243
 244     test "if user is authenticated", %{conn: _conn} do
 245       %{conn: conn} = oauth_access(["read:statuses"])
 246
 247       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 248       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 249
 250       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 251       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 252     end
 253   end
 254
 255   describe "direct" do
 256     test "direct timeline", %{conn: conn} do
 257       user_one = insert(:user)
 258       user_two = insert(:user)
 259
 260       {:ok, user_two} = User.follow(user_two, user_one)
 261
 262       {:ok, direct} =
 263         CommonAPI.post(user_one, %{
 264           status: "Hi @#{user_two.nickname}!",
 265           visibility: "direct"
 266         })
 267
 268       {:ok, _follower_only} =
 269         CommonAPI.post(user_one, %{
 270           status: "Hi @#{user_two.nickname}!",
 271           visibility: "private"
 272         })
 273
 274       conn_user_two =
 275         conn
 276         |> assign(:user, user_two)
 277         |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
 278
 279       # Only direct should be visible here
 280       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 281
 282       assert [status] = json_response_and_validate_schema(res_conn, :ok)
 283
 284       assert %{"visibility" => "direct"} = status
 285       assert status["url"] != direct.data["id"]
 286
 287       # User should be able to see their own direct message
 288       res_conn =
 289         build_conn()
 290         |> assign(:user, user_one)
 291         |> assign(:token, insert(:oauth_token, user: user_one, scopes: ["read:statuses"]))
 292         |> get("api/v1/timelines/direct")
 293
 294       [status] = json_response_and_validate_schema(res_conn, :ok)
 295
 296       assert %{"visibility" => "direct"} = status
 297
 298       # Both should be visible here
 299       res_conn = get(conn_user_two, "api/v1/timelines/home")
 300
 301       [_s1, _s2] = json_response_and_validate_schema(res_conn, :ok)
 302
 303       # Test pagination
 304       Enum.each(1..20, fn _ ->
 305         {:ok, _} =
 306           CommonAPI.post(user_one, %{
 307             status: "Hi @#{user_two.nickname}!",
 308             visibility: "direct"
 309           })
 310       end)
 311
 312       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 313
 314       statuses = json_response_and_validate_schema(res_conn, :ok)
 315       assert length(statuses) == 20
 316
 317       max_id = List.last(statuses)["id"]
 318
 319       res_conn = get(conn_user_two, "api/v1/timelines/direct?max_id=#{max_id}")
 320
 321       assert [status] = json_response_and_validate_schema(res_conn, :ok)
 322
 323       assert status["url"] != direct.data["id"]
 324     end
 325
 326     test "doesn't include DMs from blocked users" do
 327       %{user: blocker, conn: conn} = oauth_access(["read:statuses"])
 328       blocked = insert(:user)
 329       other_user = insert(:user)
 330       {:ok, _user_relationship} = User.block(blocker, blocked)
 331
 332       {:ok, _blocked_direct} =
 333         CommonAPI.post(blocked, %{
 334           status: "Hi @#{blocker.nickname}!",
 335           visibility: "direct"
 336         })
 337
 338       {:ok, direct} =
 339         CommonAPI.post(other_user, %{
 340           status: "Hi @#{blocker.nickname}!",
 341           visibility: "direct"
 342         })
 343
 344       res_conn = get(conn, "api/v1/timelines/direct")
 345
 346       [status] = json_response_and_validate_schema(res_conn, :ok)
 347       assert status["id"] == direct.id
 348     end
 349   end
 350
 351   describe "list" do
 352     setup do: oauth_access(["read:lists"])
 353
 354     test "list timeline", %{user: user, conn: conn} do
 355       other_user = insert(:user)
 356       {:ok, _activity_one} = CommonAPI.post(user, %{status: "Marisa is cute."})
 357       {:ok, activity_two} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 358       {:ok, list} = Pleroma.List.create("name", user)
 359       {:ok, list} = Pleroma.List.follow(list, other_user)
 360
 361       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 362
 363       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 364
 365       assert id == to_string(activity_two.id)
 366     end
 367
 368     test "list timeline does not leak non-public statuses for unfollowed users", %{
 369       user: user,
 370       conn: conn
 371     } do
 372       other_user = insert(:user)
 373       {:ok, activity_one} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 374
 375       {:ok, _activity_two} =
 376         CommonAPI.post(other_user, %{
 377           status: "Marisa is cute.",
 378           visibility: "private"
 379         })
 380
 381       {:ok, list} = Pleroma.List.create("name", user)
 382       {:ok, list} = Pleroma.List.follow(list, other_user)
 383
 384       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 385
 386       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 387
 388       assert id == to_string(activity_one.id)
 389     end
 390   end
 391
 392   describe "hashtag" do
 393     setup do: oauth_access(["n/a"])
 394
 395     @tag capture_log: true
 396     test "hashtag timeline", %{conn: conn} do
 397       following = insert(:user)
 398
 399       {:ok, activity} = CommonAPI.post(following, %{status: "test #2hu"})
 400
 401       nconn = get(conn, "/api/v1/timelines/tag/2hu")
 402
 403       assert [%{"id" => id}] = json_response_and_validate_schema(nconn, :ok)
 404
 405       assert id == to_string(activity.id)
 406
 407       # works for different capitalization too
 408       nconn = get(conn, "/api/v1/timelines/tag/2HU")
 409
 410       assert [%{"id" => id}] = json_response_and_validate_schema(nconn, :ok)
 411
 412       assert id == to_string(activity.id)
 413     end
 414
 415     test "multi-hashtag timeline", %{conn: conn} do
 416       user = insert(:user)
 417
 418       {:ok, activity_test} = CommonAPI.post(user, %{status: "#test"})
 419       {:ok, activity_test1} = CommonAPI.post(user, %{status: "#test #test1"})
 420       {:ok, activity_none} = CommonAPI.post(user, %{status: "#test #none"})
 421
 422       any_test = get(conn, "/api/v1/timelines/tag/test?any[]=test1")
 423
 424       [status_none, status_test1, status_test] = json_response_and_validate_schema(any_test, :ok)
 425
 426       assert to_string(activity_test.id) == status_test["id"]
 427       assert to_string(activity_test1.id) == status_test1["id"]
 428       assert to_string(activity_none.id) == status_none["id"]
 429
 430       restricted_test = get(conn, "/api/v1/timelines/tag/test?all[]=test1&none[]=none")
 431
 432       assert [status_test1] == json_response_and_validate_schema(restricted_test, :ok)
 433
 434       all_test = get(conn, "/api/v1/timelines/tag/test?all[]=none")
 435
 436       assert [status_none] == json_response_and_validate_schema(all_test, :ok)
 437     end
 438   end
 439 end