git.squeep.com Git - akkoma/blob - test/web/static_fe/static_fe_controller_test.exs

   1 defmodule Pleroma.Web.StaticFE.StaticFEControllerTest do
   2   use Pleroma.Web.ConnCase
   3
   4   alias Pleroma.Activity
   5   alias Pleroma.Config
   6   alias Pleroma.Web.ActivityPub.Transmogrifier
   7   alias Pleroma.Web.CommonAPI
   8
   9   import Pleroma.Factory
  10
  11   setup_all do: clear_config([:static_fe, :enabled], true)
  12   setup do: clear_config([:instance, :federating], true)
  13
  14   setup %{conn: conn} do
  15     conn = put_req_header(conn, "accept", "text/html")
  16     user = insert(:user)
  17
  18     %{conn: conn, user: user}
  19   end
  20
  21   describe "user profile html" do
  22     test "just the profile as HTML", %{conn: conn, user: user} do
  23       conn = get(conn, "/users/#{user.nickname}")
  24
  25       assert html_response(conn, 200) =~ user.nickname
  26     end
  27
  28     test "404 when user not found", %{conn: conn} do
  29       conn = get(conn, "/users/limpopo")
  30
  31       assert html_response(conn, 404) =~ "not found"
  32     end
  33
  34     test "profile does not include private messages", %{conn: conn, user: user} do
  35       CommonAPI.post(user, %{"status" => "public"})
  36       CommonAPI.post(user, %{"status" => "private", "visibility" => "private"})
  37
  38       conn = get(conn, "/users/#{user.nickname}")
  39
  40       html = html_response(conn, 200)
  41
  42       assert html =~ ">public<"
  43       refute html =~ ">private<"
  44     end
  45
  46     test "pagination", %{conn: conn, user: user} do
  47       Enum.map(1..30, fn i -> CommonAPI.post(user, %{"status" => "test#{i}"}) end)
  48
  49       conn = get(conn, "/users/#{user.nickname}")
  50
  51       html = html_response(conn, 200)
  52
  53       assert html =~ ">test30<"
  54       assert html =~ ">test11<"
  55       refute html =~ ">test10<"
  56       refute html =~ ">test1<"
  57     end
  58
  59     test "pagination, page 2", %{conn: conn, user: user} do
  60       activities = Enum.map(1..30, fn i -> CommonAPI.post(user, %{"status" => "test#{i}"}) end)
  61       {:ok, a11} = Enum.at(activities, 11)
  62
  63       conn = get(conn, "/users/#{user.nickname}?max_id=#{a11.id}")
  64
  65       html = html_response(conn, 200)
  66
  67       assert html =~ ">test1<"
  68       assert html =~ ">test10<"
  69       refute html =~ ">test20<"
  70       refute html =~ ">test29<"
  71     end
  72
  73     test "it requires authentication if instance is NOT federating", %{conn: conn, user: user} do
  74       ensure_federating_or_authenticated(conn, "/users/#{user.nickname}", user)
  75     end
  76   end
  77
  78   describe "notice html" do
  79     test "single notice page", %{conn: conn, user: user} do
  80       {:ok, activity} = CommonAPI.post(user, %{"status" => "testing a thing!"})
  81
  82       conn = get(conn, "/notice/#{activity.id}")
  83
  84       html = html_response(conn, 200)
  85       assert html =~ "<header>"
  86       assert html =~ user.nickname
  87       assert html =~ "testing a thing!"
  88     end
  89
  90     test "filters HTML tags", %{conn: conn} do
  91       user = insert(:user)
  92       {:ok, activity} = CommonAPI.post(user, %{"status" => "<script>alert('xss')</script>"})
  93
  94       conn =
  95         conn
  96         |> put_req_header("accept", "text/html")
  97         |> get("/notice/#{activity.id}")
  98
  99       html = html_response(conn, 200)
 100       assert html =~ ~s[&lt;script&gt;alert(&#39;xss&#39;)&lt;/script&gt;]
 101     end
 102
 103     test "shows the whole thread", %{conn: conn, user: user} do
 104       {:ok, activity} = CommonAPI.post(user, %{"status" => "space: the final frontier"})
 105
 106       CommonAPI.post(user, %{
 107         "status" => "these are the voyages or something",
 108         "in_reply_to_status_id" => activity.id
 109       })
 110
 111       conn = get(conn, "/notice/#{activity.id}")
 112
 113       html = html_response(conn, 200)
 114       assert html =~ "the final frontier"
 115       assert html =~ "voyages"
 116     end
 117
 118     test "redirect by AP object ID", %{conn: conn, user: user} do
 119       {:ok, %Activity{data: %{"object" => object_url}}} =
 120         CommonAPI.post(user, %{"status" => "beam me up"})
 121
 122       conn = get(conn, URI.parse(object_url).path)
 123
 124       assert html_response(conn, 302) =~ "redirected"
 125     end
 126
 127     test "redirect by activity ID", %{conn: conn, user: user} do
 128       {:ok, %Activity{data: %{"id" => id}}} =
 129         CommonAPI.post(user, %{"status" => "I'm a doctor, not a devops!"})
 130
 131       conn = get(conn, URI.parse(id).path)
 132
 133       assert html_response(conn, 302) =~ "redirected"
 134     end
 135
 136     test "404 when notice not found", %{conn: conn} do
 137       conn = get(conn, "/notice/88c9c317")
 138
 139       assert html_response(conn, 404) =~ "not found"
 140     end
 141
 142     test "404 for private status", %{conn: conn, user: user} do
 143       {:ok, activity} =
 144         CommonAPI.post(user, %{"status" => "don't show me!", "visibility" => "private"})
 145
 146       conn = get(conn, "/notice/#{activity.id}")
 147
 148       assert html_response(conn, 404) =~ "not found"
 149     end
 150
 151     test "302 for remote cached status", %{conn: conn, user: user} do
 152       message = %{
 153         "@context" => "https://www.w3.org/ns/activitystreams",
 154         "to" => user.follower_address,
 155         "cc" => "https://www.w3.org/ns/activitystreams#Public",
 156         "type" => "Create",
 157         "object" => %{
 158           "content" => "blah blah blah",
 159           "type" => "Note",
 160           "attributedTo" => user.ap_id,
 161           "inReplyTo" => nil
 162         },
 163         "actor" => user.ap_id
 164       }
 165
 166       assert {:ok, activity} = Transmogrifier.handle_incoming(message)
 167
 168       conn = get(conn, "/notice/#{activity.id}")
 169
 170       assert html_response(conn, 302) =~ "redirected"
 171     end
 172
 173     test "it requires authentication if instance is NOT federating", %{conn: conn, user: user} do
 174       {:ok, activity} = CommonAPI.post(user, %{"status" => "testing a thing!"})
 175
 176       ensure_federating_or_authenticated(conn, "/notice/#{activity.id}", user)
 177     end
 178   end
 179 end