git.squeep.com Git - akkoma/blob - test/web/mastodon_api/controllers/timeline_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.TimelineControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   import Pleroma.Factory
   9   import Tesla.Mock
  10
  11   alias Pleroma.Config
  12   alias Pleroma.User
  13   alias Pleroma.Web.CommonAPI
  14
  15   setup do
  16     mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
  17     :ok
  18   end
  19
  20   describe "home" do
  21     setup do: oauth_access(["read:statuses"])
  22
  23     test "does NOT embed account/pleroma/relationship in statuses", %{
  24       user: user,
  25       conn: conn
  26     } do
  27       other_user = insert(:user)
  28
  29       {:ok, _} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})
  30
  31       response =
  32         conn
  33         |> assign(:user, user)
  34         |> get("/api/v1/timelines/home")
  35         |> json_response_and_validate_schema(200)
  36
  37       assert Enum.all?(response, fn n ->
  38                get_in(n, ["account", "pleroma", "relationship"]) == %{}
  39              end)
  40     end
  41
  42     test "the home timeline when the direct messages are excluded", %{user: user, conn: conn} do
  43       {:ok, public_activity} = CommonAPI.post(user, %{status: ".", visibility: "public"})
  44       {:ok, direct_activity} = CommonAPI.post(user, %{status: ".", visibility: "direct"})
  45
  46       {:ok, unlisted_activity} = CommonAPI.post(user, %{status: ".", visibility: "unlisted"})
  47
  48       {:ok, private_activity} = CommonAPI.post(user, %{status: ".", visibility: "private"})
  49
  50       conn = get(conn, "/api/v1/timelines/home?exclude_visibilities[]=direct")
  51
  52       assert status_ids = json_response_and_validate_schema(conn, :ok) |> Enum.map(& &1["id"])
  53       assert public_activity.id in status_ids
  54       assert unlisted_activity.id in status_ids
  55       assert private_activity.id in status_ids
  56       refute direct_activity.id in status_ids
  57     end
  58   end
  59
  60   describe "public" do
  61     @tag capture_log: true
  62     test "the public timeline", %{conn: conn} do
  63       user = insert(:user)
  64
  65       {:ok, activity} = CommonAPI.post(user, %{status: "test"})
  66
  67       _activity = insert(:note_activity, local: false)
  68
  69       conn = get(conn, "/api/v1/timelines/public?local=False")
  70
  71       assert length(json_response_and_validate_schema(conn, :ok)) == 2
  72
  73       conn = get(build_conn(), "/api/v1/timelines/public?local=True")
  74
  75       assert [%{"content" => "test"}] = json_response_and_validate_schema(conn, :ok)
  76
  77       conn = get(build_conn(), "/api/v1/timelines/public?local=1")
  78
  79       assert [%{"content" => "test"}] = json_response_and_validate_schema(conn, :ok)
  80
  81       # does not contain repeats
  82       {:ok, _} = CommonAPI.repeat(activity.id, user)
  83
  84       conn = get(build_conn(), "/api/v1/timelines/public?local=true")
  85
  86       assert [_] = json_response_and_validate_schema(conn, :ok)
  87     end
  88
  89     test "the public timeline includes only public statuses for an authenticated user" do
  90       %{user: user, conn: conn} = oauth_access(["read:statuses"])
  91
  92       {:ok, _activity} = CommonAPI.post(user, %{status: "test"})
  93       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "private"})
  94       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "unlisted"})
  95       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "direct"})
  96
  97       res_conn = get(conn, "/api/v1/timelines/public")
  98       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
  99     end
 100
 101     test "doesn't return replies if follower is posting with blocked user" do
 102       %{conn: conn, user: blocker} = oauth_access(["read:statuses"])
 103       [blockee, friend] = insert_list(2, :user)
 104       {:ok, blocker} = User.follow(blocker, friend)
 105       {:ok, _} = User.block(blocker, blockee)
 106
 107       conn = assign(conn, :user, blocker)
 108
 109       {:ok, %{id: activity_id} = activity} = CommonAPI.post(friend, %{status: "hey!"})
 110
 111       {:ok, reply_from_blockee} =
 112         CommonAPI.post(blockee, %{status: "heya", in_reply_to_status_id: activity})
 113
 114       {:ok, _reply_from_friend} =
 115         CommonAPI.post(friend, %{status: "status", in_reply_to_status_id: reply_from_blockee})
 116
 117       res_conn = get(conn, "/api/v1/timelines/public")
 118       [%{"id" => ^activity_id}] = json_response_and_validate_schema(res_conn, 200)
 119     end
 120
 121     test "doesn't return replies if follow is posting with users from blocked domain" do
 122       %{conn: conn, user: blocker} = oauth_access(["read:statuses"])
 123       friend = insert(:user)
 124       blockee = insert(:user, ap_id: "https://example.com/users/blocked")
 125       {:ok, blocker} = User.follow(blocker, friend)
 126       {:ok, blocker} = User.block_domain(blocker, "example.com")
 127
 128       conn = assign(conn, :user, blocker)
 129
 130       {:ok, %{id: activity_id} = activity} = CommonAPI.post(friend, %{status: "hey!"})
 131
 132       {:ok, reply_from_blockee} =
 133         CommonAPI.post(blockee, %{status: "heya", in_reply_to_status_id: activity})
 134
 135       {:ok, _reply_from_friend} =
 136         CommonAPI.post(friend, %{status: "status", in_reply_to_status_id: reply_from_blockee})
 137
 138       res_conn = get(conn, "/api/v1/timelines/public")
 139
 140       activities = json_response_and_validate_schema(res_conn, 200)
 141       [%{"id" => ^activity_id}] = activities
 142     end
 143
 144     test "can be filtered by instance", %{conn: conn} do
 145       user = insert(:user, ap_id: "https://lain.com/users/lain")
 146       insert(:note_activity, local: false)
 147       insert(:note_activity, local: false)
 148
 149       {:ok, _} = CommonAPI.post(user, %{status: "test"})
 150
 151       conn = get(conn, "/api/v1/timelines/public?instance=lain.com")
 152
 153       assert length(json_response_and_validate_schema(conn, :ok)) == 1
 154     end
 155   end
 156
 157   defp local_and_remote_activities do
 158     insert(:note_activity)
 159     insert(:note_activity, local: false)
 160     :ok
 161   end
 162
 163   describe "public with restrict unauthenticated timeline for local and federated timelines" do
 164     setup do: local_and_remote_activities()
 165
 166     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 167
 168     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 169
 170     test "if user is unauthenticated", %{conn: conn} do
 171       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 172
 173       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 174                "error" => "authorization required for timeline view"
 175              }
 176
 177       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 178
 179       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 180                "error" => "authorization required for timeline view"
 181              }
 182     end
 183
 184     test "if user is authenticated" do
 185       %{conn: conn} = oauth_access(["read:statuses"])
 186
 187       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 188       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 189
 190       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 191       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 192     end
 193   end
 194
 195   describe "public with restrict unauthenticated timeline for local" do
 196     setup do: local_and_remote_activities()
 197
 198     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 199
 200     test "if user is unauthenticated", %{conn: conn} do
 201       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 202
 203       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 204                "error" => "authorization required for timeline view"
 205              }
 206
 207       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 208       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 209     end
 210
 211     test "if user is authenticated", %{conn: _conn} do
 212       %{conn: conn} = oauth_access(["read:statuses"])
 213
 214       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 215       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 216
 217       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 218       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 219     end
 220   end
 221
 222   describe "public with restrict unauthenticated timeline for remote" do
 223     setup do: local_and_remote_activities()
 224
 225     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 226
 227     test "if user is unauthenticated", %{conn: conn} do
 228       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 229       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 230
 231       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 232
 233       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 234                "error" => "authorization required for timeline view"
 235              }
 236     end
 237
 238     test "if user is authenticated", %{conn: _conn} do
 239       %{conn: conn} = oauth_access(["read:statuses"])
 240
 241       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 242       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 243
 244       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 245       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 246     end
 247   end
 248
 249   describe "direct" do
 250     test "direct timeline", %{conn: conn} do
 251       user_one = insert(:user)
 252       user_two = insert(:user)
 253
 254       {:ok, user_two} = User.follow(user_two, user_one)
 255
 256       {:ok, direct} =
 257         CommonAPI.post(user_one, %{
 258           status: "Hi @#{user_two.nickname}!",
 259           visibility: "direct"
 260         })
 261
 262       {:ok, _follower_only} =
 263         CommonAPI.post(user_one, %{
 264           status: "Hi @#{user_two.nickname}!",
 265           visibility: "private"
 266         })
 267
 268       conn_user_two =
 269         conn
 270         |> assign(:user, user_two)
 271         |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
 272
 273       # Only direct should be visible here
 274       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 275
 276       assert [status] = json_response_and_validate_schema(res_conn, :ok)
 277
 278       assert %{"visibility" => "direct"} = status
 279       assert status["url"] != direct.data["id"]
 280
 281       # User should be able to see their own direct message
 282       res_conn =
 283         build_conn()
 284         |> assign(:user, user_one)
 285         |> assign(:token, insert(:oauth_token, user: user_one, scopes: ["read:statuses"]))
 286         |> get("api/v1/timelines/direct")
 287
 288       [status] = json_response_and_validate_schema(res_conn, :ok)
 289
 290       assert %{"visibility" => "direct"} = status
 291
 292       # Both should be visible here
 293       res_conn = get(conn_user_two, "api/v1/timelines/home")
 294
 295       [_s1, _s2] = json_response_and_validate_schema(res_conn, :ok)
 296
 297       # Test pagination
 298       Enum.each(1..20, fn _ ->
 299         {:ok, _} =
 300           CommonAPI.post(user_one, %{
 301             status: "Hi @#{user_two.nickname}!",
 302             visibility: "direct"
 303           })
 304       end)
 305
 306       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 307
 308       statuses = json_response_and_validate_schema(res_conn, :ok)
 309       assert length(statuses) == 20
 310
 311       max_id = List.last(statuses)["id"]
 312
 313       res_conn = get(conn_user_two, "api/v1/timelines/direct?max_id=#{max_id}")
 314
 315       assert [status] = json_response_and_validate_schema(res_conn, :ok)
 316
 317       assert status["url"] != direct.data["id"]
 318     end
 319
 320     test "doesn't include DMs from blocked users" do
 321       %{user: blocker, conn: conn} = oauth_access(["read:statuses"])
 322       blocked = insert(:user)
 323       other_user = insert(:user)
 324       {:ok, _user_relationship} = User.block(blocker, blocked)
 325
 326       {:ok, _blocked_direct} =
 327         CommonAPI.post(blocked, %{
 328           status: "Hi @#{blocker.nickname}!",
 329           visibility: "direct"
 330         })
 331
 332       {:ok, direct} =
 333         CommonAPI.post(other_user, %{
 334           status: "Hi @#{blocker.nickname}!",
 335           visibility: "direct"
 336         })
 337
 338       res_conn = get(conn, "api/v1/timelines/direct")
 339
 340       [status] = json_response_and_validate_schema(res_conn, :ok)
 341       assert status["id"] == direct.id
 342     end
 343   end
 344
 345   describe "list" do
 346     setup do: oauth_access(["read:lists"])
 347
 348     test "list timeline", %{user: user, conn: conn} do
 349       other_user = insert(:user)
 350       {:ok, _activity_one} = CommonAPI.post(user, %{status: "Marisa is cute."})
 351       {:ok, activity_two} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 352       {:ok, list} = Pleroma.List.create("name", user)
 353       {:ok, list} = Pleroma.List.follow(list, other_user)
 354
 355       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 356
 357       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 358
 359       assert id == to_string(activity_two.id)
 360     end
 361
 362     test "list timeline does not leak non-public statuses for unfollowed users", %{
 363       user: user,
 364       conn: conn
 365     } do
 366       other_user = insert(:user)
 367       {:ok, activity_one} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 368
 369       {:ok, _activity_two} =
 370         CommonAPI.post(other_user, %{
 371           status: "Marisa is cute.",
 372           visibility: "private"
 373         })
 374
 375       {:ok, list} = Pleroma.List.create("name", user)
 376       {:ok, list} = Pleroma.List.follow(list, other_user)
 377
 378       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 379
 380       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 381
 382       assert id == to_string(activity_one.id)
 383     end
 384   end
 385
 386   describe "hashtag" do
 387     setup do: oauth_access(["n/a"])
 388
 389     @tag capture_log: true
 390     test "hashtag timeline", %{conn: conn} do
 391       following = insert(:user)
 392
 393       {:ok, activity} = CommonAPI.post(following, %{status: "test #2hu"})
 394
 395       nconn = get(conn, "/api/v1/timelines/tag/2hu")
 396
 397       assert [%{"id" => id}] = json_response_and_validate_schema(nconn, :ok)
 398
 399       assert id == to_string(activity.id)
 400
 401       # works for different capitalization too
 402       nconn = get(conn, "/api/v1/timelines/tag/2HU")
 403
 404       assert [%{"id" => id}] = json_response_and_validate_schema(nconn, :ok)
 405
 406       assert id == to_string(activity.id)
 407     end
 408
 409     test "multi-hashtag timeline", %{conn: conn} do
 410       user = insert(:user)
 411
 412       {:ok, activity_test} = CommonAPI.post(user, %{status: "#test"})
 413       {:ok, activity_test1} = CommonAPI.post(user, %{status: "#test #test1"})
 414       {:ok, activity_none} = CommonAPI.post(user, %{status: "#test #none"})
 415
 416       any_test = get(conn, "/api/v1/timelines/tag/test?any[]=test1")
 417
 418       [status_none, status_test1, status_test] = json_response_and_validate_schema(any_test, :ok)
 419
 420       assert to_string(activity_test.id) == status_test["id"]
 421       assert to_string(activity_test1.id) == status_test1["id"]
 422       assert to_string(activity_none.id) == status_none["id"]
 423
 424       restricted_test = get(conn, "/api/v1/timelines/tag/test?all[]=test1&none[]=none")
 425
 426       assert [status_test1] == json_response_and_validate_schema(restricted_test, :ok)
 427
 428       all_test = get(conn, "/api/v1/timelines/tag/test?all[]=none")
 429
 430       assert [status_none] == json_response_and_validate_schema(all_test, :ok)
 431     end
 432   end
 433
 434   describe "hashtag timeline handling of :restrict_unauthenticated setting" do
 435     setup do
 436       user = insert(:user)
 437       {:ok, activity1} = CommonAPI.post(user, %{status: "test #tag1"})
 438       {:ok, _activity2} = CommonAPI.post(user, %{status: "test #tag1"})
 439
 440       activity1
 441       |> Ecto.Changeset.change(%{local: false})
 442       |> Pleroma.Repo.update()
 443
 444       base_uri = "/api/v1/timelines/tag/tag1"
 445       error_response = %{"error" => "authorization required for timeline view"}
 446
 447       %{base_uri: base_uri, error_response: error_response}
 448     end
 449
 450     defp ensure_authenticated_access(base_uri) do
 451       %{conn: auth_conn} = oauth_access(["read:statuses"])
 452
 453       res_conn = get(auth_conn, "#{base_uri}?local=true")
 454       assert length(json_response(res_conn, 200)) == 1
 455
 456       res_conn = get(auth_conn, "#{base_uri}?local=false")
 457       assert length(json_response(res_conn, 200)) == 2
 458     end
 459
 460     test "with `%{local: true, federated: true}`, returns 403 for unauthenticated users", %{
 461       conn: conn,
 462       base_uri: base_uri,
 463       error_response: error_response
 464     } do
 465       clear_config([:restrict_unauthenticated, :timelines, :local], true)
 466       clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 467
 468       for local <- [true, false] do
 469         res_conn = get(conn, "#{base_uri}?local=#{local}")
 470
 471         assert json_response(res_conn, :unauthorized) == error_response
 472       end
 473
 474       ensure_authenticated_access(base_uri)
 475     end
 476
 477     test "with `%{local: false, federated: true}`, forbids unauthenticated access to federated timeline",
 478          %{conn: conn, base_uri: base_uri, error_response: error_response} do
 479       clear_config([:restrict_unauthenticated, :timelines, :local], false)
 480       clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 481
 482       res_conn = get(conn, "#{base_uri}?local=true")
 483       assert length(json_response(res_conn, 200)) == 1
 484
 485       res_conn = get(conn, "#{base_uri}?local=false")
 486       assert json_response(res_conn, :unauthorized) == error_response
 487
 488       ensure_authenticated_access(base_uri)
 489     end
 490
 491     test "with `%{local: true, federated: false}`, forbids unauthenticated access to public timeline" <>
 492            "(but not to local public activities which are delivered as part of federated timeline)",
 493          %{conn: conn, base_uri: base_uri, error_response: error_response} do
 494       clear_config([:restrict_unauthenticated, :timelines, :local], true)
 495       clear_config([:restrict_unauthenticated, :timelines, :federated], false)
 496
 497       res_conn = get(conn, "#{base_uri}?local=true")
 498       assert json_response(res_conn, :unauthorized) == error_response
 499
 500       # Note: local activities get delivered as part of federated timeline
 501       res_conn = get(conn, "#{base_uri}?local=false")
 502       assert length(json_response(res_conn, 200)) == 2
 503
 504       ensure_authenticated_access(base_uri)
 505     end
 506   end
 507 end