Merge remote-tracking branch 'upstream/develop' into chat-moderation
[akkoma] / test / web / twitter_api / remote_follow_controller_test.exs
1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
4
5 defmodule Pleroma.Web.TwitterAPI.RemoteFollowControllerTest do
6 use Pleroma.Web.ConnCase
7
8 alias Pleroma.Config
9 alias Pleroma.MFA
10 alias Pleroma.MFA.TOTP
11 alias Pleroma.User
12 alias Pleroma.Web.CommonAPI
13
14 import ExUnit.CaptureLog
15 import Pleroma.Factory
16 import Ecto.Query
17
18 setup do
19 Tesla.Mock.mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
20 :ok
21 end
22
23 setup_all do: clear_config([:instance, :federating], true)
24 setup do: clear_config([:instance])
25 setup do: clear_config([:frontend_configurations, :pleroma_fe])
26 setup do: clear_config([:user, :deny_follow_blocked])
27
28 describe "GET /ostatus_subscribe - remote_follow/2" do
29 test "adds status to pleroma instance if the `acct` is a status", %{conn: conn} do
30 assert conn
31 |> get(
32 remote_follow_path(conn, :follow, %{
33 acct: "https://mastodon.social/users/emelie/statuses/101849165031453009"
34 })
35 )
36 |> redirected_to() =~ "/notice/"
37 end
38
39 test "show follow account page if the `acct` is a account link", %{conn: conn} do
40 response =
41 conn
42 |> get(remote_follow_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"}))
43 |> html_response(200)
44
45 assert response =~ "Log in to follow"
46 end
47
48 test "show follow page if the `acct` is a account link", %{conn: conn} do
49 user = insert(:user)
50
51 response =
52 conn
53 |> assign(:user, user)
54 |> get(remote_follow_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"}))
55 |> html_response(200)
56
57 assert response =~ "Remote follow"
58 end
59
60 test "show follow page with error when user cannot fecth by `acct` link", %{conn: conn} do
61 user = insert(:user)
62
63 assert capture_log(fn ->
64 response =
65 conn
66 |> assign(:user, user)
67 |> get(
68 remote_follow_path(conn, :follow, %{
69 acct: "https://mastodon.social/users/not_found"
70 })
71 )
72 |> html_response(200)
73
74 assert response =~ "Error fetching user"
75 end) =~ "Object has been deleted"
76 end
77 end
78
79 describe "POST /ostatus_subscribe - do_follow/2 with assigned user " do
80 test "required `follow | write:follows` scope", %{conn: conn} do
81 user = insert(:user)
82 user2 = insert(:user)
83 read_token = insert(:oauth_token, user: user, scopes: ["read"])
84
85 assert capture_log(fn ->
86 response =
87 conn
88 |> assign(:user, user)
89 |> assign(:token, read_token)
90 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
91 |> response(200)
92
93 assert response =~ "Error following account"
94 end) =~ "Insufficient permissions: follow | write:follows."
95 end
96
97 test "follows user", %{conn: conn} do
98 user = insert(:user)
99 user2 = insert(:user)
100
101 conn =
102 conn
103 |> assign(:user, user)
104 |> assign(:token, insert(:oauth_token, user: user, scopes: ["write:follows"]))
105 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
106
107 assert redirected_to(conn) == "/users/#{user2.id}"
108 end
109
110 test "returns error when user is deactivated", %{conn: conn} do
111 user = insert(:user, deactivated: true)
112 user2 = insert(:user)
113
114 response =
115 conn
116 |> assign(:user, user)
117 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
118 |> response(200)
119
120 assert response =~ "Error following account"
121 end
122
123 test "returns error when user is blocked", %{conn: conn} do
124 Pleroma.Config.put([:user, :deny_follow_blocked], true)
125 user = insert(:user)
126 user2 = insert(:user)
127
128 {:ok, _user_block} = Pleroma.User.block(user2, user)
129
130 response =
131 conn
132 |> assign(:user, user)
133 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
134 |> response(200)
135
136 assert response =~ "Error following account"
137 end
138
139 test "returns error when followee not found", %{conn: conn} do
140 user = insert(:user)
141
142 response =
143 conn
144 |> assign(:user, user)
145 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => "jimm"}})
146 |> response(200)
147
148 assert response =~ "Error following account"
149 end
150
151 test "returns success result when user already in followers", %{conn: conn} do
152 user = insert(:user)
153 user2 = insert(:user)
154 {:ok, _, _, _} = CommonAPI.follow(user, user2)
155
156 conn =
157 conn
158 |> assign(:user, refresh_record(user))
159 |> assign(:token, insert(:oauth_token, user: user, scopes: ["write:follows"]))
160 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
161
162 assert redirected_to(conn) == "/users/#{user2.id}"
163 end
164 end
165
166 describe "POST /ostatus_subscribe - follow/2 with enabled Two-Factor Auth " do
167 test "render the MFA login form", %{conn: conn} do
168 otp_secret = TOTP.generate_secret()
169
170 user =
171 insert(:user,
172 multi_factor_authentication_settings: %MFA.Settings{
173 enabled: true,
174 totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
175 }
176 )
177
178 user2 = insert(:user)
179
180 response =
181 conn
182 |> post(remote_follow_path(conn, :do_follow), %{
183 "authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
184 })
185 |> response(200)
186
187 mfa_token = Pleroma.Repo.one(from(q in Pleroma.MFA.Token, where: q.user_id == ^user.id))
188
189 assert response =~ "Two-factor authentication"
190 assert response =~ "Authentication code"
191 assert response =~ mfa_token.token
192 refute user2.follower_address in User.following(user)
193 end
194
195 test "returns error when password is incorrect", %{conn: conn} do
196 otp_secret = TOTP.generate_secret()
197
198 user =
199 insert(:user,
200 multi_factor_authentication_settings: %MFA.Settings{
201 enabled: true,
202 totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
203 }
204 )
205
206 user2 = insert(:user)
207
208 response =
209 conn
210 |> post(remote_follow_path(conn, :do_follow), %{
211 "authorization" => %{"name" => user.nickname, "password" => "test1", "id" => user2.id}
212 })
213 |> response(200)
214
215 assert response =~ "Wrong username or password"
216 refute user2.follower_address in User.following(user)
217 end
218
219 test "follows", %{conn: conn} do
220 otp_secret = TOTP.generate_secret()
221
222 user =
223 insert(:user,
224 multi_factor_authentication_settings: %MFA.Settings{
225 enabled: true,
226 totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
227 }
228 )
229
230 {:ok, %{token: token}} = MFA.Token.create(user)
231
232 user2 = insert(:user)
233 otp_token = TOTP.generate_token(otp_secret)
234
235 conn =
236 conn
237 |> post(
238 remote_follow_path(conn, :do_follow),
239 %{
240 "mfa" => %{"code" => otp_token, "token" => token, "id" => user2.id}
241 }
242 )
243
244 assert redirected_to(conn) == "/users/#{user2.id}"
245 assert user2.follower_address in User.following(user)
246 end
247
248 test "returns error when auth code is incorrect", %{conn: conn} do
249 otp_secret = TOTP.generate_secret()
250
251 user =
252 insert(:user,
253 multi_factor_authentication_settings: %MFA.Settings{
254 enabled: true,
255 totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
256 }
257 )
258
259 {:ok, %{token: token}} = MFA.Token.create(user)
260
261 user2 = insert(:user)
262 otp_token = TOTP.generate_token(TOTP.generate_secret())
263
264 response =
265 conn
266 |> post(
267 remote_follow_path(conn, :do_follow),
268 %{
269 "mfa" => %{"code" => otp_token, "token" => token, "id" => user2.id}
270 }
271 )
272 |> response(200)
273
274 assert response =~ "Wrong authentication code"
275 refute user2.follower_address in User.following(user)
276 end
277 end
278
279 describe "POST /ostatus_subscribe - follow/2 without assigned user " do
280 test "follows", %{conn: conn} do
281 user = insert(:user)
282 user2 = insert(:user)
283
284 conn =
285 conn
286 |> post(remote_follow_path(conn, :do_follow), %{
287 "authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
288 })
289
290 assert redirected_to(conn) == "/users/#{user2.id}"
291 assert user2.follower_address in User.following(user)
292 end
293
294 test "returns error when followee not found", %{conn: conn} do
295 user = insert(:user)
296
297 response =
298 conn
299 |> post(remote_follow_path(conn, :do_follow), %{
300 "authorization" => %{"name" => user.nickname, "password" => "test", "id" => "jimm"}
301 })
302 |> response(200)
303
304 assert response =~ "Error following account"
305 end
306
307 test "returns error when login invalid", %{conn: conn} do
308 user = insert(:user)
309
310 response =
311 conn
312 |> post(remote_follow_path(conn, :do_follow), %{
313 "authorization" => %{"name" => "jimm", "password" => "test", "id" => user.id}
314 })
315 |> response(200)
316
317 assert response =~ "Wrong username or password"
318 end
319
320 test "returns error when password invalid", %{conn: conn} do
321 user = insert(:user)
322 user2 = insert(:user)
323
324 response =
325 conn
326 |> post(remote_follow_path(conn, :do_follow), %{
327 "authorization" => %{"name" => user.nickname, "password" => "42", "id" => user2.id}
328 })
329 |> response(200)
330
331 assert response =~ "Wrong username or password"
332 end
333
334 test "returns error when user is blocked", %{conn: conn} do
335 Pleroma.Config.put([:user, :deny_follow_blocked], true)
336 user = insert(:user)
337 user2 = insert(:user)
338 {:ok, _user_block} = Pleroma.User.block(user2, user)
339
340 response =
341 conn
342 |> post(remote_follow_path(conn, :do_follow), %{
343 "authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
344 })
345 |> response(200)
346
347 assert response =~ "Error following account"
348 end
349 end
350 end