git.squeep.com Git - akkoma/blob - test/web/twitter_api/twitter_api_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.TwitterAPI.ControllerTest do
   6   use Pleroma.Web.ConnCase
   7   alias Pleroma.Web.TwitterAPI.Representers.ActivityRepresenter
   8   alias Pleroma.Builders.{ActivityBuilder, UserBuilder}
   9   alias Pleroma.{Repo, Activity, User, Object, Notification}
  10   alias Pleroma.Web.ActivityPub.ActivityPub
  11   alias Pleroma.Web.TwitterAPI.UserView
  12   alias Pleroma.Web.TwitterAPI.NotificationView
  13   alias Pleroma.Web.CommonAPI
  14   alias Pleroma.Web.TwitterAPI.TwitterAPI
  15   alias Comeonin.Pbkdf2
  16   alias Ecto.Changeset
  17
  18   import Pleroma.Factory
  19
  20   @banner "data:image/gif;base64,R0lGODlhEAAQAMQAAORHHOVSKudfOulrSOp3WOyDZu6QdvCchPGolfO0o/XBs/fNwfjZ0frl3/zy7////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAkAABAALAAAAAAQABAAAAVVICSOZGlCQAosJ6mu7fiyZeKqNKToQGDsM8hBADgUXoGAiqhSvp5QAnQKGIgUhwFUYLCVDFCrKUE1lBavAViFIDlTImbKC5Gm2hB0SlBCBMQiB0UjIQA7"
  21
  22   describe "POST /api/account/update_profile_banner" do
  23     test "it updates the banner", %{conn: conn} do
  24       user = insert(:user)
  25
  26       conn
  27       |> assign(:user, user)
  28       |> post(authenticated_twitter_api__path(conn, :update_banner), %{"banner" => @banner})
  29       |> json_response(200)
  30
  31       user = refresh_record(user)
  32       assert user.info.banner["type"] == "Image"
  33     end
  34   end
  35
  36   describe "POST /api/qvitter/update_background_image" do
  37     test "it updates the background", %{conn: conn} do
  38       user = insert(:user)
  39
  40       conn
  41       |> assign(:user, user)
  42       |> post(authenticated_twitter_api__path(conn, :update_background), %{"img" => @banner})
  43       |> json_response(200)
  44
  45       user = refresh_record(user)
  46       assert user.info.background["type"] == "Image"
  47     end
  48   end
  49
  50   describe "POST /api/account/verify_credentials" do
  51     setup [:valid_user]
  52
  53     test "without valid credentials", %{conn: conn} do
  54       conn = post(conn, "/api/account/verify_credentials.json")
  55       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
  56     end
  57
  58     test "with credentials", %{conn: conn, user: user} do
  59       response =
  60         conn
  61         |> with_credentials(user.nickname, "test")
  62         |> post("/api/account/verify_credentials.json")
  63         |> json_response(200)
  64
  65       assert response == UserView.render("show.json", %{user: user, token: response["token"]})
  66     end
  67   end
  68
  69   describe "POST /statuses/update.json" do
  70     setup [:valid_user]
  71
  72     test "without valid credentials", %{conn: conn} do
  73       conn = post(conn, "/api/statuses/update.json")
  74       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
  75     end
  76
  77     test "with credentials", %{conn: conn, user: user} do
  78       conn_with_creds = conn |> with_credentials(user.nickname, "test")
  79       request_path = "/api/statuses/update.json"
  80
  81       error_response = %{
  82         "request" => request_path,
  83         "error" => "Client must provide a 'status' parameter with a value."
  84       }
  85
  86       conn =
  87         conn_with_creds
  88         |> post(request_path)
  89
  90       assert json_response(conn, 400) == error_response
  91
  92       conn =
  93         conn_with_creds
  94         |> post(request_path, %{status: ""})
  95
  96       assert json_response(conn, 400) == error_response
  97
  98       conn =
  99         conn_with_creds
 100         |> post(request_path, %{status: " "})
 101
 102       assert json_response(conn, 400) == error_response
 103
 104       # we post with visibility private in order to avoid triggering relay
 105       conn =
 106         conn_with_creds
 107         |> post(request_path, %{status: "Nice meme.", visibility: "private"})
 108
 109       assert json_response(conn, 200) ==
 110                ActivityRepresenter.to_map(Repo.one(Activity), %{user: user})
 111     end
 112   end
 113
 114   describe "GET /statuses/public_timeline.json" do
 115     test "returns statuses", %{conn: conn} do
 116       user = insert(:user)
 117       activities = ActivityBuilder.insert_list(30, %{}, %{user: user})
 118       ActivityBuilder.insert_list(10, %{}, %{user: user})
 119       since_id = List.last(activities).id
 120
 121       conn =
 122         conn
 123         |> get("/api/statuses/public_timeline.json", %{since_id: since_id})
 124
 125       response = json_response(conn, 200)
 126
 127       assert length(response) == 10
 128     end
 129
 130     test "returns 403 to unauthenticated request when the instance is not public", %{conn: conn} do
 131       instance =
 132         Application.get_env(:pleroma, :instance)
 133         |> Keyword.put(:public, false)
 134
 135       Application.put_env(:pleroma, :instance, instance)
 136
 137       conn
 138       |> get("/api/statuses/public_timeline.json")
 139       |> json_response(403)
 140
 141       instance =
 142         Application.get_env(:pleroma, :instance)
 143         |> Keyword.put(:public, true)
 144
 145       Application.put_env(:pleroma, :instance, instance)
 146     end
 147
 148     test "returns 200 to unauthenticated request when the instance is public", %{conn: conn} do
 149       conn
 150       |> get("/api/statuses/public_timeline.json")
 151       |> json_response(200)
 152     end
 153   end
 154
 155   describe "GET /statuses/public_and_external_timeline.json" do
 156     test "returns 403 to unauthenticated request when the instance is not public", %{conn: conn} do
 157       instance =
 158         Application.get_env(:pleroma, :instance)
 159         |> Keyword.put(:public, false)
 160
 161       Application.put_env(:pleroma, :instance, instance)
 162
 163       conn
 164       |> get("/api/statuses/public_and_external_timeline.json")
 165       |> json_response(403)
 166
 167       instance =
 168         Application.get_env(:pleroma, :instance)
 169         |> Keyword.put(:public, true)
 170
 171       Application.put_env(:pleroma, :instance, instance)
 172     end
 173
 174     test "returns 200 to unauthenticated request when the instance is public", %{conn: conn} do
 175       conn
 176       |> get("/api/statuses/public_and_external_timeline.json")
 177       |> json_response(200)
 178     end
 179   end
 180
 181   describe "GET /statuses/show/:id.json" do
 182     test "returns one status", %{conn: conn} do
 183       user = insert(:user)
 184       {:ok, activity} = CommonAPI.post(user, %{"status" => "Hey!"})
 185       actor = Repo.get_by!(User, ap_id: activity.data["actor"])
 186
 187       conn =
 188         conn
 189         |> get("/api/statuses/show/#{activity.id}.json")
 190
 191       response = json_response(conn, 200)
 192
 193       assert response == ActivityRepresenter.to_map(activity, %{user: actor})
 194     end
 195   end
 196
 197   describe "GET /users/show.json" do
 198     test "gets user with screen_name", %{conn: conn} do
 199       user = insert(:user)
 200
 201       conn =
 202         conn
 203         |> get("/api/users/show.json", %{"screen_name" => user.nickname})
 204
 205       response = json_response(conn, 200)
 206
 207       assert response["id"] == user.id
 208     end
 209
 210     test "gets user with user_id", %{conn: conn} do
 211       user = insert(:user)
 212
 213       conn =
 214         conn
 215         |> get("/api/users/show.json", %{"user_id" => user.id})
 216
 217       response = json_response(conn, 200)
 218
 219       assert response["id"] == user.id
 220     end
 221
 222     test "gets a user for a logged in user", %{conn: conn} do
 223       user = insert(:user)
 224       logged_in = insert(:user)
 225
 226       {:ok, logged_in, user, _activity} = TwitterAPI.follow(logged_in, %{"user_id" => user.id})
 227
 228       conn =
 229         conn
 230         |> with_credentials(logged_in.nickname, "test")
 231         |> get("/api/users/show.json", %{"user_id" => user.id})
 232
 233       response = json_response(conn, 200)
 234
 235       assert response["following"] == true
 236     end
 237   end
 238
 239   describe "GET /statusnet/conversation/:id.json" do
 240     test "returns the statuses in the conversation", %{conn: conn} do
 241       {:ok, _user} = UserBuilder.insert()
 242       {:ok, activity} = ActivityBuilder.insert(%{"type" => "Create", "context" => "2hu"})
 243       {:ok, _activity_two} = ActivityBuilder.insert(%{"type" => "Create", "context" => "2hu"})
 244       {:ok, _activity_three} = ActivityBuilder.insert(%{"type" => "Create", "context" => "3hu"})
 245
 246       conn =
 247         conn
 248         |> get("/api/statusnet/conversation/#{activity.data["context_id"]}.json")
 249
 250       response = json_response(conn, 200)
 251
 252       assert length(response) == 2
 253     end
 254   end
 255
 256   describe "GET /statuses/friends_timeline.json" do
 257     setup [:valid_user]
 258
 259     test "without valid credentials", %{conn: conn} do
 260       conn = get(conn, "/api/statuses/friends_timeline.json")
 261       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 262     end
 263
 264     test "with credentials", %{conn: conn, user: current_user} do
 265       user = insert(:user)
 266
 267       activities =
 268         ActivityBuilder.insert_list(30, %{"to" => [User.ap_followers(user)]}, %{user: user})
 269
 270       returned_activities =
 271         ActivityBuilder.insert_list(10, %{"to" => [User.ap_followers(user)]}, %{user: user})
 272
 273       other_user = insert(:user)
 274       ActivityBuilder.insert_list(10, %{}, %{user: other_user})
 275       since_id = List.last(activities).id
 276
 277       current_user =
 278         Changeset.change(current_user, following: [User.ap_followers(user)])
 279         |> Repo.update!()
 280
 281       conn =
 282         conn
 283         |> with_credentials(current_user.nickname, "test")
 284         |> get("/api/statuses/friends_timeline.json", %{since_id: since_id})
 285
 286       response = json_response(conn, 200)
 287
 288       assert length(response) == 10
 289
 290       assert response ==
 291                Enum.map(returned_activities, fn activity ->
 292                  ActivityRepresenter.to_map(activity, %{
 293                    user: User.get_cached_by_ap_id(activity.data["actor"]),
 294                    for: current_user
 295                  })
 296                end)
 297     end
 298   end
 299
 300   describe "GET /statuses/dm_timeline.json" do
 301     test "it show direct messages", %{conn: conn} do
 302       user_one = insert(:user)
 303       user_two = insert(:user)
 304
 305       {:ok, user_two} = User.follow(user_two, user_one)
 306
 307       {:ok, direct} =
 308         CommonAPI.post(user_one, %{
 309           "status" => "Hi @#{user_two.nickname}!",
 310           "visibility" => "direct"
 311         })
 312
 313       {:ok, direct_two} =
 314         CommonAPI.post(user_two, %{
 315           "status" => "Hi @#{user_one.nickname}!",
 316           "visibility" => "direct"
 317         })
 318
 319       {:ok, _follower_only} =
 320         CommonAPI.post(user_one, %{
 321           "status" => "Hi @#{user_two.nickname}!",
 322           "visibility" => "private"
 323         })
 324
 325       # Only direct should be visible here
 326       res_conn =
 327         conn
 328         |> assign(:user, user_two)
 329         |> get("/api/statuses/dm_timeline.json")
 330
 331       [status, status_two] = json_response(res_conn, 200)
 332       assert status["id"] == direct_two.id
 333       assert status_two["id"] == direct.id
 334     end
 335   end
 336
 337   describe "GET /statuses/mentions.json" do
 338     setup [:valid_user]
 339
 340     test "without valid credentials", %{conn: conn} do
 341       conn = get(conn, "/api/statuses/mentions.json")
 342       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 343     end
 344
 345     test "with credentials", %{conn: conn, user: current_user} do
 346       {:ok, activity} =
 347         ActivityBuilder.insert(%{"to" => [current_user.ap_id]}, %{user: current_user})
 348
 349       conn =
 350         conn
 351         |> with_credentials(current_user.nickname, "test")
 352         |> get("/api/statuses/mentions.json")
 353
 354       response = json_response(conn, 200)
 355
 356       assert length(response) == 1
 357
 358       assert Enum.at(response, 0) ==
 359                ActivityRepresenter.to_map(activity, %{
 360                  user: current_user,
 361                  mentioned: [current_user]
 362                })
 363     end
 364   end
 365
 366   describe "GET /api/qvitter/statuses/notifications.json" do
 367     setup [:valid_user]
 368
 369     test "without valid credentials", %{conn: conn} do
 370       conn = get(conn, "/api/qvitter/statuses/notifications.json")
 371       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 372     end
 373
 374     test "with credentials", %{conn: conn, user: current_user} do
 375       other_user = insert(:user)
 376
 377       {:ok, _activity} =
 378         ActivityBuilder.insert(%{"to" => [current_user.ap_id]}, %{user: other_user})
 379
 380       conn =
 381         conn
 382         |> with_credentials(current_user.nickname, "test")
 383         |> get("/api/qvitter/statuses/notifications.json")
 384
 385       response = json_response(conn, 200)
 386
 387       assert length(response) == 1
 388
 389       assert response ==
 390                NotificationView.render("notification.json", %{
 391                  notifications: Notification.for_user(current_user),
 392                  for: current_user
 393                })
 394     end
 395   end
 396
 397   describe "POST /api/qvitter/statuses/notifications/read" do
 398     setup [:valid_user]
 399
 400     test "without valid credentials", %{conn: conn} do
 401       conn = post(conn, "/api/qvitter/statuses/notifications/read", %{"latest_id" => 1_234_567})
 402       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 403     end
 404
 405     test "with credentials, without any params", %{conn: conn, user: current_user} do
 406       conn =
 407         conn
 408         |> with_credentials(current_user.nickname, "test")
 409         |> post("/api/qvitter/statuses/notifications/read")
 410
 411       assert json_response(conn, 400) == %{
 412                "error" => "You need to specify latest_id",
 413                "request" => "/api/qvitter/statuses/notifications/read"
 414              }
 415     end
 416
 417     test "with credentials, with params", %{conn: conn, user: current_user} do
 418       other_user = insert(:user)
 419
 420       {:ok, _activity} =
 421         ActivityBuilder.insert(%{"to" => [current_user.ap_id]}, %{user: other_user})
 422
 423       response_conn =
 424         conn
 425         |> with_credentials(current_user.nickname, "test")
 426         |> get("/api/qvitter/statuses/notifications.json")
 427
 428       [notification] = response = json_response(response_conn, 200)
 429
 430       assert length(response) == 1
 431
 432       assert notification["is_seen"] == 0
 433
 434       response_conn =
 435         conn
 436         |> with_credentials(current_user.nickname, "test")
 437         |> post("/api/qvitter/statuses/notifications/read", %{"latest_id" => notification["id"]})
 438
 439       [notification] = response = json_response(response_conn, 200)
 440
 441       assert length(response) == 1
 442
 443       assert notification["is_seen"] == 1
 444     end
 445   end
 446
 447   describe "GET /statuses/user_timeline.json" do
 448     setup [:valid_user]
 449
 450     test "without any params", %{conn: conn} do
 451       conn = get(conn, "/api/statuses/user_timeline.json")
 452
 453       assert json_response(conn, 400) == %{
 454                "error" => "You need to specify screen_name or user_id",
 455                "request" => "/api/statuses/user_timeline.json"
 456              }
 457     end
 458
 459     test "with user_id", %{conn: conn} do
 460       user = insert(:user)
 461       {:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: user})
 462
 463       conn = get(conn, "/api/statuses/user_timeline.json", %{"user_id" => user.id})
 464       response = json_response(conn, 200)
 465       assert length(response) == 1
 466       assert Enum.at(response, 0) == ActivityRepresenter.to_map(activity, %{user: user})
 467     end
 468
 469     test "with screen_name", %{conn: conn} do
 470       user = insert(:user)
 471       {:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: user})
 472
 473       conn = get(conn, "/api/statuses/user_timeline.json", %{"screen_name" => user.nickname})
 474       response = json_response(conn, 200)
 475       assert length(response) == 1
 476       assert Enum.at(response, 0) == ActivityRepresenter.to_map(activity, %{user: user})
 477     end
 478
 479     test "with credentials", %{conn: conn, user: current_user} do
 480       {:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: current_user})
 481
 482       conn =
 483         conn
 484         |> with_credentials(current_user.nickname, "test")
 485         |> get("/api/statuses/user_timeline.json")
 486
 487       response = json_response(conn, 200)
 488
 489       assert length(response) == 1
 490       assert Enum.at(response, 0) == ActivityRepresenter.to_map(activity, %{user: current_user})
 491     end
 492
 493     test "with credentials with user_id", %{conn: conn, user: current_user} do
 494       user = insert(:user)
 495       {:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: user})
 496
 497       conn =
 498         conn
 499         |> with_credentials(current_user.nickname, "test")
 500         |> get("/api/statuses/user_timeline.json", %{"user_id" => user.id})
 501
 502       response = json_response(conn, 200)
 503
 504       assert length(response) == 1
 505       assert Enum.at(response, 0) == ActivityRepresenter.to_map(activity, %{user: user})
 506     end
 507
 508     test "with credentials screen_name", %{conn: conn, user: current_user} do
 509       user = insert(:user)
 510       {:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: user})
 511
 512       conn =
 513         conn
 514         |> with_credentials(current_user.nickname, "test")
 515         |> get("/api/statuses/user_timeline.json", %{"screen_name" => user.nickname})
 516
 517       response = json_response(conn, 200)
 518
 519       assert length(response) == 1
 520       assert Enum.at(response, 0) == ActivityRepresenter.to_map(activity, %{user: user})
 521     end
 522
 523     test "with credentials with user_id, excluding RTs", %{conn: conn, user: current_user} do
 524       user = insert(:user)
 525       {:ok, activity} = ActivityBuilder.insert(%{"id" => 1, "type" => "Create"}, %{user: user})
 526       {:ok, _} = ActivityBuilder.insert(%{"id" => 2, "type" => "Announce"}, %{user: user})
 527
 528       conn =
 529         conn
 530         |> with_credentials(current_user.nickname, "test")
 531         |> get("/api/statuses/user_timeline.json", %{
 532           "user_id" => user.id,
 533           "include_rts" => "false"
 534         })
 535
 536       response = json_response(conn, 200)
 537
 538       assert length(response) == 1
 539       assert Enum.at(response, 0) == ActivityRepresenter.to_map(activity, %{user: user})
 540
 541       conn =
 542         conn
 543         |> get("/api/statuses/user_timeline.json", %{"user_id" => user.id, "include_rts" => "0"})
 544
 545       response = json_response(conn, 200)
 546
 547       assert length(response) == 1
 548       assert Enum.at(response, 0) == ActivityRepresenter.to_map(activity, %{user: user})
 549     end
 550   end
 551
 552   describe "POST /friendships/create.json" do
 553     setup [:valid_user]
 554
 555     test "without valid credentials", %{conn: conn} do
 556       conn = post(conn, "/api/friendships/create.json")
 557       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 558     end
 559
 560     test "with credentials", %{conn: conn, user: current_user} do
 561       followed = insert(:user)
 562
 563       conn =
 564         conn
 565         |> with_credentials(current_user.nickname, "test")
 566         |> post("/api/friendships/create.json", %{user_id: followed.id})
 567
 568       current_user = Repo.get(User, current_user.id)
 569       assert User.ap_followers(followed) in current_user.following
 570
 571       assert json_response(conn, 200) ==
 572                UserView.render("show.json", %{user: followed, for: current_user})
 573     end
 574   end
 575
 576   describe "POST /friendships/destroy.json" do
 577     setup [:valid_user]
 578
 579     test "without valid credentials", %{conn: conn} do
 580       conn = post(conn, "/api/friendships/destroy.json")
 581       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 582     end
 583
 584     test "with credentials", %{conn: conn, user: current_user} do
 585       followed = insert(:user)
 586
 587       {:ok, current_user} = User.follow(current_user, followed)
 588       assert User.ap_followers(followed) in current_user.following
 589       ActivityPub.follow(current_user, followed)
 590
 591       conn =
 592         conn
 593         |> with_credentials(current_user.nickname, "test")
 594         |> post("/api/friendships/destroy.json", %{user_id: followed.id})
 595
 596       current_user = Repo.get(User, current_user.id)
 597       assert current_user.following == [current_user.ap_id]
 598
 599       assert json_response(conn, 200) ==
 600                UserView.render("show.json", %{user: followed, for: current_user})
 601     end
 602   end
 603
 604   describe "POST /blocks/create.json" do
 605     setup [:valid_user]
 606
 607     test "without valid credentials", %{conn: conn} do
 608       conn = post(conn, "/api/blocks/create.json")
 609       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 610     end
 611
 612     test "with credentials", %{conn: conn, user: current_user} do
 613       blocked = insert(:user)
 614
 615       conn =
 616         conn
 617         |> with_credentials(current_user.nickname, "test")
 618         |> post("/api/blocks/create.json", %{user_id: blocked.id})
 619
 620       current_user = Repo.get(User, current_user.id)
 621       assert User.blocks?(current_user, blocked)
 622
 623       assert json_response(conn, 200) ==
 624                UserView.render("show.json", %{user: blocked, for: current_user})
 625     end
 626   end
 627
 628   describe "POST /blocks/destroy.json" do
 629     setup [:valid_user]
 630
 631     test "without valid credentials", %{conn: conn} do
 632       conn = post(conn, "/api/blocks/destroy.json")
 633       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 634     end
 635
 636     test "with credentials", %{conn: conn, user: current_user} do
 637       blocked = insert(:user)
 638
 639       {:ok, current_user, blocked} = TwitterAPI.block(current_user, %{"user_id" => blocked.id})
 640       assert User.blocks?(current_user, blocked)
 641
 642       conn =
 643         conn
 644         |> with_credentials(current_user.nickname, "test")
 645         |> post("/api/blocks/destroy.json", %{user_id: blocked.id})
 646
 647       current_user = Repo.get(User, current_user.id)
 648       assert current_user.info.blocks == []
 649
 650       assert json_response(conn, 200) ==
 651                UserView.render("show.json", %{user: blocked, for: current_user})
 652     end
 653   end
 654
 655   describe "GET /help/test.json" do
 656     test "returns \"ok\"", %{conn: conn} do
 657       conn = get(conn, "/api/help/test.json")
 658       assert json_response(conn, 200) == "ok"
 659     end
 660   end
 661
 662   describe "POST /api/qvitter/update_avatar.json" do
 663     setup [:valid_user]
 664
 665     test "without valid credentials", %{conn: conn} do
 666       conn = post(conn, "/api/qvitter/update_avatar.json")
 667       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 668     end
 669
 670     test "with credentials", %{conn: conn, user: current_user} do
 671       avatar_image = File.read!("test/fixtures/avatar_data_uri")
 672
 673       conn =
 674         conn
 675         |> with_credentials(current_user.nickname, "test")
 676         |> post("/api/qvitter/update_avatar.json", %{img: avatar_image})
 677
 678       current_user = Repo.get(User, current_user.id)
 679       assert is_map(current_user.avatar)
 680
 681       assert json_response(conn, 200) ==
 682                UserView.render("show.json", %{user: current_user, for: current_user})
 683     end
 684   end
 685
 686   describe "GET /api/qvitter/mutes.json" do
 687     setup [:valid_user]
 688
 689     test "unimplemented mutes without valid credentials", %{conn: conn} do
 690       conn = get(conn, "/api/qvitter/mutes.json")
 691       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 692     end
 693
 694     test "unimplemented mutes with credentials", %{conn: conn, user: current_user} do
 695       response =
 696         conn
 697         |> with_credentials(current_user.nickname, "test")
 698         |> get("/api/qvitter/mutes.json")
 699         |> json_response(200)
 700
 701       assert [] = response
 702     end
 703   end
 704
 705   describe "POST /api/favorites/create/:id" do
 706     setup [:valid_user]
 707
 708     test "without valid credentials", %{conn: conn} do
 709       note_activity = insert(:note_activity)
 710       conn = post(conn, "/api/favorites/create/#{note_activity.id}.json")
 711       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 712     end
 713
 714     test "with credentials", %{conn: conn, user: current_user} do
 715       note_activity = insert(:note_activity)
 716
 717       conn =
 718         conn
 719         |> with_credentials(current_user.nickname, "test")
 720         |> post("/api/favorites/create/#{note_activity.id}.json")
 721
 722       assert json_response(conn, 200)
 723     end
 724
 725     test "with credentials, invalid param", %{conn: conn, user: current_user} do
 726       conn =
 727         conn
 728         |> with_credentials(current_user.nickname, "test")
 729         |> post("/api/favorites/create/wrong.json")
 730
 731       assert json_response(conn, 400)
 732     end
 733
 734     test "with credentials, invalid activity", %{conn: conn, user: current_user} do
 735       conn =
 736         conn
 737         |> with_credentials(current_user.nickname, "test")
 738         |> post("/api/favorites/create/1.json")
 739
 740       assert json_response(conn, 500)
 741     end
 742   end
 743
 744   describe "POST /api/favorites/destroy/:id" do
 745     setup [:valid_user]
 746
 747     test "without valid credentials", %{conn: conn} do
 748       note_activity = insert(:note_activity)
 749       conn = post(conn, "/api/favorites/destroy/#{note_activity.id}.json")
 750       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 751     end
 752
 753     test "with credentials", %{conn: conn, user: current_user} do
 754       note_activity = insert(:note_activity)
 755       object = Object.get_by_ap_id(note_activity.data["object"]["id"])
 756       ActivityPub.like(current_user, object)
 757
 758       conn =
 759         conn
 760         |> with_credentials(current_user.nickname, "test")
 761         |> post("/api/favorites/destroy/#{note_activity.id}.json")
 762
 763       assert json_response(conn, 200)
 764     end
 765   end
 766
 767   describe "POST /api/statuses/retweet/:id" do
 768     setup [:valid_user]
 769
 770     test "without valid credentials", %{conn: conn} do
 771       note_activity = insert(:note_activity)
 772       conn = post(conn, "/api/statuses/retweet/#{note_activity.id}.json")
 773       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 774     end
 775
 776     test "with credentials", %{conn: conn, user: current_user} do
 777       note_activity = insert(:note_activity)
 778
 779       request_path = "/api/statuses/retweet/#{note_activity.id}.json"
 780
 781       response =
 782         conn
 783         |> with_credentials(current_user.nickname, "test")
 784         |> post(request_path)
 785
 786       activity = Repo.get(Activity, note_activity.id)
 787       activity_user = Repo.get_by(User, ap_id: note_activity.data["actor"])
 788
 789       assert json_response(response, 200) ==
 790                ActivityRepresenter.to_map(activity, %{user: activity_user, for: current_user})
 791     end
 792   end
 793
 794   describe "POST /api/statuses/unretweet/:id" do
 795     setup [:valid_user]
 796
 797     test "without valid credentials", %{conn: conn} do
 798       note_activity = insert(:note_activity)
 799       conn = post(conn, "/api/statuses/unretweet/#{note_activity.id}.json")
 800       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 801     end
 802
 803     test "with credentials", %{conn: conn, user: current_user} do
 804       note_activity = insert(:note_activity)
 805
 806       request_path = "/api/statuses/retweet/#{note_activity.id}.json"
 807
 808       _response =
 809         conn
 810         |> with_credentials(current_user.nickname, "test")
 811         |> post(request_path)
 812
 813       request_path = String.replace(request_path, "retweet", "unretweet")
 814
 815       response =
 816         conn
 817         |> with_credentials(current_user.nickname, "test")
 818         |> post(request_path)
 819
 820       activity = Repo.get(Activity, note_activity.id)
 821       activity_user = Repo.get_by(User, ap_id: note_activity.data["actor"])
 822
 823       assert json_response(response, 200) ==
 824                ActivityRepresenter.to_map(activity, %{user: activity_user, for: current_user})
 825     end
 826   end
 827
 828   describe "POST /api/account/register" do
 829     test "it creates a new user", %{conn: conn} do
 830       data = %{
 831         "nickname" => "lain",
 832         "email" => "lain@wired.jp",
 833         "fullname" => "lain iwakura",
 834         "bio" => "close the world.",
 835         "password" => "bear",
 836         "confirm" => "bear"
 837       }
 838
 839       conn =
 840         conn
 841         |> post("/api/account/register", data)
 842
 843       user = json_response(conn, 200)
 844
 845       fetched_user = Repo.get_by(User, nickname: "lain")
 846       assert user == UserView.render("show.json", %{user: fetched_user})
 847     end
 848
 849     test "it returns errors on a problem", %{conn: conn} do
 850       data = %{
 851         "email" => "lain@wired.jp",
 852         "fullname" => "lain iwakura",
 853         "bio" => "close the world.",
 854         "password" => "bear",
 855         "confirm" => "bear"
 856       }
 857
 858       conn =
 859         conn
 860         |> post("/api/account/register", data)
 861
 862       errors = json_response(conn, 400)
 863
 864       assert is_binary(errors["error"])
 865     end
 866   end
 867
 868   describe "POST /api/account/password_reset, with valid parameters" do
 869     setup %{conn: conn} do
 870       user = insert(:user)
 871       conn = post(conn, "/api/account/password_reset?email=#{user.email}")
 872       %{conn: conn, user: user}
 873     end
 874
 875     test "it returns 204", %{conn: conn} do
 876       assert json_response(conn, :no_content)
 877     end
 878
 879     test "it creates a PasswordResetToken record for user", %{user: user} do
 880       token_record = Repo.get_by(Pleroma.PasswordResetToken, user_id: user.id)
 881       assert token_record
 882     end
 883
 884     test "it sends an email to user", %{user: user} do
 885       token_record = Repo.get_by(Pleroma.PasswordResetToken, user_id: user.id)
 886
 887       Swoosh.TestAssertions.assert_email_sent(
 888         Pleroma.UserEmail.password_reset_email(user, token_record.token)
 889       )
 890     end
 891   end
 892
 893   describe "POST /api/account/password_reset, with invalid parameters" do
 894     setup [:valid_user]
 895
 896     test "it returns 500 when user is not found", %{conn: conn, user: user} do
 897       conn = post(conn, "/api/account/password_reset?email=nonexisting_#{user.email}")
 898       assert json_response(conn, :internal_server_error)
 899     end
 900
 901     test "it returns 500 when user is not local", %{conn: conn, user: user} do
 902       {:ok, user} = Repo.update(Changeset.change(user, local: false))
 903       conn = post(conn, "/api/account/password_reset?email=#{user.email}")
 904       assert json_response(conn, :internal_server_error)
 905     end
 906   end
 907
 908   describe "GET /api/account/confirm_email/:id/:token" do
 909     setup do
 910       user = insert(:user)
 911       info_change = User.Info.confirmation_changeset(user.info, :unconfirmed)
 912
 913       {:ok, user} =
 914         user
 915         |> Changeset.change()
 916         |> Changeset.put_embed(:info, info_change)
 917         |> Repo.update()
 918
 919       assert user.info.confirmation_pending
 920
 921       [user: user]
 922     end
 923
 924     test "it redirects to root url", %{conn: conn, user: user} do
 925       conn = get(conn, "/api/account/confirm_email/#{user.id}/#{user.info.confirmation_token}")
 926
 927       assert 302 == conn.status
 928     end
 929
 930     test "it confirms the user account", %{conn: conn, user: user} do
 931       get(conn, "/api/account/confirm_email/#{user.id}/#{user.info.confirmation_token}")
 932
 933       user = Repo.get(User, user.id)
 934
 935       refute user.info.confirmation_pending
 936       refute user.info.confirmation_token
 937     end
 938
 939     test "it returns 500 if user cannot be found by id", %{conn: conn, user: user} do
 940       conn = get(conn, "/api/account/confirm_email/0/#{user.info.confirmation_token}")
 941
 942       assert 500 == conn.status
 943     end
 944
 945     test "it returns 500 if token is invalid", %{conn: conn, user: user} do
 946       conn = get(conn, "/api/account/confirm_email/#{user.id}/wrong_token")
 947
 948       assert 500 == conn.status
 949     end
 950   end
 951
 952   describe "POST /api/account/resend_confirmation_email" do
 953     setup do
 954       setting = Pleroma.Config.get([:instance, :account_activation_required])
 955
 956       unless setting do
 957         Pleroma.Config.put([:instance, :account_activation_required], true)
 958         on_exit(fn -> Pleroma.Config.put([:instance, :account_activation_required], setting) end)
 959       end
 960
 961       user = insert(:user)
 962       info_change = User.Info.confirmation_changeset(user.info, :unconfirmed)
 963
 964       {:ok, user} =
 965         user
 966         |> Changeset.change()
 967         |> Changeset.put_embed(:info, info_change)
 968         |> Repo.update()
 969
 970       assert user.info.confirmation_pending
 971
 972       [user: user]
 973     end
 974
 975     test "it returns 204 No Content", %{conn: conn, user: user} do
 976       conn
 977       |> assign(:user, user)
 978       |> post("/api/account/resend_confirmation_email?email=#{user.email}")
 979       |> json_response(:no_content)
 980     end
 981
 982     test "it sends confirmation email", %{conn: conn, user: user} do
 983       conn
 984       |> assign(:user, user)
 985       |> post("/api/account/resend_confirmation_email?email=#{user.email}")
 986
 987       Swoosh.TestAssertions.assert_email_sent(Pleroma.UserEmail.account_confirmation_email(user))
 988     end
 989   end
 990
 991   describe "GET /api/externalprofile/show" do
 992     test "it returns the user", %{conn: conn} do
 993       user = insert(:user)
 994       other_user = insert(:user)
 995
 996       conn =
 997         conn
 998         |> assign(:user, user)
 999         |> get("/api/externalprofile/show", %{profileurl: other_user.ap_id})
1000
1001       assert json_response(conn, 200) == UserView.render("show.json", %{user: other_user})
1002     end
1003   end
1004
1005   describe "GET /api/statuses/followers" do
1006     test "it returns a user's followers", %{conn: conn} do
1007       user = insert(:user)
1008       follower_one = insert(:user)
1009       follower_two = insert(:user)
1010       _not_follower = insert(:user)
1011
1012       {:ok, follower_one} = User.follow(follower_one, user)
1013       {:ok, follower_two} = User.follow(follower_two, user)
1014
1015       conn =
1016         conn
1017         |> assign(:user, user)
1018         |> get("/api/statuses/followers")
1019
1020       expected = UserView.render("index.json", %{users: [follower_one, follower_two], for: user})
1021       result = json_response(conn, 200)
1022       assert Enum.sort(expected) == Enum.sort(result)
1023     end
1024
1025     test "it returns a given user's followers with user_id", %{conn: conn} do
1026       user = insert(:user)
1027       follower_one = insert(:user)
1028       follower_two = insert(:user)
1029       not_follower = insert(:user)
1030
1031       {:ok, follower_one} = User.follow(follower_one, user)
1032       {:ok, follower_two} = User.follow(follower_two, user)
1033
1034       conn =
1035         conn
1036         |> assign(:user, not_follower)
1037         |> get("/api/statuses/followers", %{"user_id" => user.id})
1038
1039       assert MapSet.equal?(
1040                MapSet.new(json_response(conn, 200)),
1041                MapSet.new(
1042                  UserView.render("index.json", %{
1043                    users: [follower_one, follower_two],
1044                    for: not_follower
1045                  })
1046                )
1047              )
1048     end
1049
1050     test "it returns empty for a hidden network", %{conn: conn} do
1051       user = insert(:user, %{info: %{hide_network: true}})
1052       follower_one = insert(:user)
1053       follower_two = insert(:user)
1054       not_follower = insert(:user)
1055
1056       {:ok, _follower_one} = User.follow(follower_one, user)
1057       {:ok, _follower_two} = User.follow(follower_two, user)
1058
1059       response =
1060         conn
1061         |> assign(:user, not_follower)
1062         |> get("/api/statuses/followers", %{"user_id" => user.id})
1063         |> json_response(200)
1064
1065       assert [] == response
1066     end
1067
1068     test "it returns the followers for a hidden network if requested by the user themselves", %{
1069       conn: conn
1070     } do
1071       user = insert(:user, %{info: %{hide_network: true}})
1072       follower_one = insert(:user)
1073       follower_two = insert(:user)
1074       _not_follower = insert(:user)
1075
1076       {:ok, _follower_one} = User.follow(follower_one, user)
1077       {:ok, _follower_two} = User.follow(follower_two, user)
1078
1079       conn =
1080         conn
1081         |> assign(:user, user)
1082         |> get("/api/statuses/followers", %{"user_id" => user.id})
1083
1084       refute [] == json_response(conn, 200)
1085     end
1086   end
1087
1088   describe "GET /api/statuses/friends" do
1089     test "it returns the logged in user's friends", %{conn: conn} do
1090       user = insert(:user)
1091       followed_one = insert(:user)
1092       followed_two = insert(:user)
1093       _not_followed = insert(:user)
1094
1095       {:ok, user} = User.follow(user, followed_one)
1096       {:ok, user} = User.follow(user, followed_two)
1097
1098       conn =
1099         conn
1100         |> assign(:user, user)
1101         |> get("/api/statuses/friends")
1102
1103       expected = UserView.render("index.json", %{users: [followed_one, followed_two], for: user})
1104       result = json_response(conn, 200)
1105       assert Enum.sort(expected) == Enum.sort(result)
1106     end
1107
1108     test "it returns a given user's friends with user_id", %{conn: conn} do
1109       user = insert(:user)
1110       followed_one = insert(:user)
1111       followed_two = insert(:user)
1112       _not_followed = insert(:user)
1113
1114       {:ok, user} = User.follow(user, followed_one)
1115       {:ok, user} = User.follow(user, followed_two)
1116
1117       conn =
1118         conn
1119         |> assign(:user, user)
1120         |> get("/api/statuses/friends", %{"user_id" => user.id})
1121
1122       assert MapSet.equal?(
1123                MapSet.new(json_response(conn, 200)),
1124                MapSet.new(
1125                  UserView.render("index.json", %{users: [followed_one, followed_two], for: user})
1126                )
1127              )
1128     end
1129
1130     test "it returns empty for a hidden network", %{conn: conn} do
1131       user = insert(:user, %{info: %{hide_network: true}})
1132       followed_one = insert(:user)
1133       followed_two = insert(:user)
1134       not_followed = insert(:user)
1135
1136       {:ok, user} = User.follow(user, followed_one)
1137       {:ok, user} = User.follow(user, followed_two)
1138
1139       conn =
1140         conn
1141         |> assign(:user, not_followed)
1142         |> get("/api/statuses/friends", %{"user_id" => user.id})
1143
1144       assert [] == json_response(conn, 200)
1145     end
1146
1147     test "it returns friends for a hidden network if the user themselves request it", %{
1148       conn: conn
1149     } do
1150       user = insert(:user, %{info: %{hide_network: true}})
1151       followed_one = insert(:user)
1152       followed_two = insert(:user)
1153       _not_followed = insert(:user)
1154
1155       {:ok, _user} = User.follow(user, followed_one)
1156       {:ok, _user} = User.follow(user, followed_two)
1157
1158       response =
1159         conn
1160         |> assign(:user, user)
1161         |> get("/api/statuses/friends", %{"user_id" => user.id})
1162         |> json_response(200)
1163
1164       refute [] == response
1165     end
1166
1167     test "it returns a given user's friends with screen_name", %{conn: conn} do
1168       user = insert(:user)
1169       followed_one = insert(:user)
1170       followed_two = insert(:user)
1171       _not_followed = insert(:user)
1172
1173       {:ok, user} = User.follow(user, followed_one)
1174       {:ok, user} = User.follow(user, followed_two)
1175
1176       conn =
1177         conn
1178         |> assign(:user, user)
1179         |> get("/api/statuses/friends", %{"screen_name" => user.nickname})
1180
1181       assert MapSet.equal?(
1182                MapSet.new(json_response(conn, 200)),
1183                MapSet.new(
1184                  UserView.render("index.json", %{users: [followed_one, followed_two], for: user})
1185                )
1186              )
1187     end
1188   end
1189
1190   describe "GET /friends/ids" do
1191     test "it returns a user's friends", %{conn: conn} do
1192       user = insert(:user)
1193       followed_one = insert(:user)
1194       followed_two = insert(:user)
1195       _not_followed = insert(:user)
1196
1197       {:ok, user} = User.follow(user, followed_one)
1198       {:ok, user} = User.follow(user, followed_two)
1199
1200       conn =
1201         conn
1202         |> assign(:user, user)
1203         |> get("/api/friends/ids")
1204
1205       expected = [followed_one.id, followed_two.id]
1206
1207       assert MapSet.equal?(
1208                MapSet.new(Poison.decode!(json_response(conn, 200))),
1209                MapSet.new(expected)
1210              )
1211     end
1212   end
1213
1214   describe "POST /api/account/update_profile.json" do
1215     test "it updates a user's profile", %{conn: conn} do
1216       user = insert(:user)
1217       user2 = insert(:user)
1218
1219       conn =
1220         conn
1221         |> assign(:user, user)
1222         |> post("/api/account/update_profile.json", %{
1223           "name" => "new name",
1224           "description" => "hi @#{user2.nickname}"
1225         })
1226
1227       user = Repo.get!(User, user.id)
1228       assert user.name == "new name"
1229
1230       assert user.bio ==
1231                "hi <span><a data-user='#{user2.id}' class='mention' href='#{user2.ap_id}'>@<span>#{
1232                  user2.nickname
1233                }</span></a></span>"
1234
1235       assert json_response(conn, 200) == UserView.render("user.json", %{user: user, for: user})
1236     end
1237
1238     test "it sets and un-sets hide_network", %{conn: conn} do
1239       user = insert(:user)
1240
1241       conn
1242       |> assign(:user, user)
1243       |> post("/api/account/update_profile.json", %{
1244         "hide_network" => "true"
1245       })
1246
1247       user = Repo.get!(User, user.id)
1248       assert user.info.hide_network == true
1249
1250       conn =
1251         conn
1252         |> assign(:user, user)
1253         |> post("/api/account/update_profile.json", %{
1254           "hide_network" => "false"
1255         })
1256
1257       user = Repo.get!(User, user.id)
1258       assert user.info.hide_network == false
1259       assert json_response(conn, 200) == UserView.render("user.json", %{user: user, for: user})
1260     end
1261
1262     test "it locks an account", %{conn: conn} do
1263       user = insert(:user)
1264
1265       conn =
1266         conn
1267         |> assign(:user, user)
1268         |> post("/api/account/update_profile.json", %{
1269           "locked" => "true"
1270         })
1271
1272       user = Repo.get!(User, user.id)
1273       assert user.info.locked == true
1274
1275       assert json_response(conn, 200) == UserView.render("user.json", %{user: user, for: user})
1276     end
1277
1278     test "it unlocks an account", %{conn: conn} do
1279       user = insert(:user)
1280
1281       conn =
1282         conn
1283         |> assign(:user, user)
1284         |> post("/api/account/update_profile.json", %{
1285           "locked" => "false"
1286         })
1287
1288       user = Repo.get!(User, user.id)
1289       assert user.info.locked == false
1290
1291       assert json_response(conn, 200) == UserView.render("user.json", %{user: user, for: user})
1292     end
1293   end
1294
1295   defp valid_user(_context) do
1296     user = insert(:user)
1297     [user: user]
1298   end
1299
1300   defp with_credentials(conn, username, password) do
1301     header_content = "Basic " <> Base.encode64("#{username}:#{password}")
1302     put_req_header(conn, "authorization", header_content)
1303   end
1304
1305   describe "GET /api/search.json" do
1306     test "it returns search results", %{conn: conn} do
1307       user = insert(:user)
1308       user_two = insert(:user, %{nickname: "shp@shitposter.club"})
1309
1310       {:ok, activity} = CommonAPI.post(user, %{"status" => "This is about 2hu"})
1311       {:ok, _} = CommonAPI.post(user_two, %{"status" => "This isn't"})
1312
1313       conn =
1314         conn
1315         |> get("/api/search.json", %{"q" => "2hu", "page" => "1", "rpp" => "1"})
1316
1317       assert [status] = json_response(conn, 200)
1318       assert status["id"] == activity.id
1319     end
1320   end
1321
1322   describe "GET /api/statusnet/tags/timeline/:tag.json" do
1323     test "it returns the tags timeline", %{conn: conn} do
1324       user = insert(:user)
1325       user_two = insert(:user, %{nickname: "shp@shitposter.club"})
1326
1327       {:ok, activity} = CommonAPI.post(user, %{"status" => "This is about #2hu"})
1328       {:ok, _} = CommonAPI.post(user_two, %{"status" => "This isn't"})
1329
1330       conn =
1331         conn
1332         |> get("/api/statusnet/tags/timeline/2hu.json")
1333
1334       assert [status] = json_response(conn, 200)
1335       assert status["id"] == activity.id
1336     end
1337   end
1338
1339   test "Convert newlines to <br> in bio", %{conn: conn} do
1340     user = insert(:user)
1341
1342     _conn =
1343       conn
1344       |> assign(:user, user)
1345       |> post("/api/account/update_profile.json", %{
1346         "description" => "Hello,\r\nWorld! I\n am a test."
1347       })
1348
1349     user = Repo.get!(User, user.id)
1350     assert user.bio == "Hello,<br>World! I<br> am a test."
1351   end
1352
1353   describe "POST /api/pleroma/change_password" do
1354     setup [:valid_user]
1355
1356     test "without credentials", %{conn: conn} do
1357       conn = post(conn, "/api/pleroma/change_password")
1358       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
1359     end
1360
1361     test "with credentials and invalid password", %{conn: conn, user: current_user} do
1362       conn =
1363         conn
1364         |> with_credentials(current_user.nickname, "test")
1365         |> post("/api/pleroma/change_password", %{
1366           "password" => "hi",
1367           "new_password" => "newpass",
1368           "new_password_confirmation" => "newpass"
1369         })
1370
1371       assert json_response(conn, 200) == %{"error" => "Invalid password."}
1372     end
1373
1374     test "with credentials, valid password and new password and confirmation not matching", %{
1375       conn: conn,
1376       user: current_user
1377     } do
1378       conn =
1379         conn
1380         |> with_credentials(current_user.nickname, "test")
1381         |> post("/api/pleroma/change_password", %{
1382           "password" => "test",
1383           "new_password" => "newpass",
1384           "new_password_confirmation" => "notnewpass"
1385         })
1386
1387       assert json_response(conn, 200) == %{
1388                "error" => "New password does not match confirmation."
1389              }
1390     end
1391
1392     test "with credentials, valid password and invalid new password", %{
1393       conn: conn,
1394       user: current_user
1395     } do
1396       conn =
1397         conn
1398         |> with_credentials(current_user.nickname, "test")
1399         |> post("/api/pleroma/change_password", %{
1400           "password" => "test",
1401           "new_password" => "",
1402           "new_password_confirmation" => ""
1403         })
1404
1405       assert json_response(conn, 200) == %{
1406                "error" => "New password can't be blank."
1407              }
1408     end
1409
1410     test "with credentials, valid password and matching new password and confirmation", %{
1411       conn: conn,
1412       user: current_user
1413     } do
1414       conn =
1415         conn
1416         |> with_credentials(current_user.nickname, "test")
1417         |> post("/api/pleroma/change_password", %{
1418           "password" => "test",
1419           "new_password" => "newpass",
1420           "new_password_confirmation" => "newpass"
1421         })
1422
1423       assert json_response(conn, 200) == %{"status" => "success"}
1424       fetched_user = Repo.get(User, current_user.id)
1425       assert Pbkdf2.checkpw("newpass", fetched_user.password_hash) == true
1426     end
1427   end
1428
1429   describe "POST /api/pleroma/delete_account" do
1430     setup [:valid_user]
1431
1432     test "without credentials", %{conn: conn} do
1433       conn = post(conn, "/api/pleroma/delete_account")
1434       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
1435     end
1436
1437     test "with credentials and invalid password", %{conn: conn, user: current_user} do
1438       conn =
1439         conn
1440         |> with_credentials(current_user.nickname, "test")
1441         |> post("/api/pleroma/delete_account", %{"password" => "hi"})
1442
1443       assert json_response(conn, 200) == %{"error" => "Invalid password."}
1444     end
1445
1446     test "with credentials and valid password", %{conn: conn, user: current_user} do
1447       conn =
1448         conn
1449         |> with_credentials(current_user.nickname, "test")
1450         |> post("/api/pleroma/delete_account", %{"password" => "test"})
1451
1452       assert json_response(conn, 200) == %{"status" => "success"}
1453       # Wait a second for the started task to end
1454       :timer.sleep(1000)
1455     end
1456   end
1457
1458   describe "GET /api/pleroma/friend_requests" do
1459     test "it lists friend requests" do
1460       user = insert(:user)
1461       other_user = insert(:user)
1462
1463       {:ok, _activity} = ActivityPub.follow(other_user, user)
1464
1465       user = Repo.get(User, user.id)
1466       other_user = Repo.get(User, other_user.id)
1467
1468       assert User.following?(other_user, user) == false
1469
1470       conn =
1471         build_conn()
1472         |> assign(:user, user)
1473         |> get("/api/pleroma/friend_requests")
1474
1475       assert [relationship] = json_response(conn, 200)
1476       assert other_user.id == relationship["id"]
1477     end
1478   end
1479
1480   describe "POST /api/pleroma/friendships/approve" do
1481     test "it approves a friend request" do
1482       user = insert(:user)
1483       other_user = insert(:user)
1484
1485       {:ok, _activity} = ActivityPub.follow(other_user, user)
1486
1487       user = Repo.get(User, user.id)
1488       other_user = Repo.get(User, other_user.id)
1489
1490       assert User.following?(other_user, user) == false
1491
1492       conn =
1493         build_conn()
1494         |> assign(:user, user)
1495         |> post("/api/pleroma/friendships/approve", %{"user_id" => to_string(other_user.id)})
1496
1497       assert relationship = json_response(conn, 200)
1498       assert other_user.id == relationship["id"]
1499       assert relationship["follows_you"] == true
1500     end
1501   end
1502
1503   describe "POST /api/pleroma/friendships/deny" do
1504     test "it denies a friend request" do
1505       user = insert(:user)
1506       other_user = insert(:user)
1507
1508       {:ok, _activity} = ActivityPub.follow(other_user, user)
1509
1510       user = Repo.get(User, user.id)
1511       other_user = Repo.get(User, other_user.id)
1512
1513       assert User.following?(other_user, user) == false
1514
1515       conn =
1516         build_conn()
1517         |> assign(:user, user)
1518         |> post("/api/pleroma/friendships/deny", %{"user_id" => to_string(other_user.id)})
1519
1520       assert relationship = json_response(conn, 200)
1521       assert other_user.id == relationship["id"]
1522       assert relationship["follows_you"] == false
1523     end
1524   end
1525
1526   describe "GET /api/pleroma/search_user" do
1527     test "it returns users, ordered by similarity", %{conn: conn} do
1528       user = insert(:user, %{name: "eal"})
1529       user_two = insert(:user, %{name: "ean"})
1530       user_three = insert(:user, %{name: "ebn"})
1531
1532       resp =
1533         conn
1534         |> get(twitter_api_search__path(conn, :search_user), query: "eal")
1535         |> json_response(200)
1536
1537       assert length(resp) == 3
1538       assert [user.id, user_two.id, user_three.id] == Enum.map(resp, fn %{"id" => id} -> id end)
1539     end
1540   end
1541
1542   describe "POST /api/media/upload" do
1543     setup context do
1544       Pleroma.DataCase.ensure_local_uploader(context)
1545     end
1546
1547     test "it performs the upload and sets `data[actor]` with AP id of uploader user", %{
1548       conn: conn
1549     } do
1550       user = insert(:user)
1551
1552       upload_filename = "test/fixtures/image_tmp.jpg"
1553       File.cp!("test/fixtures/image.jpg", upload_filename)
1554
1555       file = %Plug.Upload{
1556         content_type: "image/jpg",
1557         path: Path.absname(upload_filename),
1558         filename: "image.jpg"
1559       }
1560
1561       response =
1562         conn
1563         |> assign(:user, user)
1564         |> put_req_header("content-type", "application/octet-stream")
1565         |> post("/api/media/upload", %{
1566           "media" => file
1567         })
1568         |> json_response(:ok)
1569
1570       assert response["media_id"]
1571       object = Repo.get(Object, response["media_id"])
1572       assert object
1573       assert object.data["actor"] == User.ap_id(user)
1574     end
1575   end
1576
1577   describe "POST /api/media/metadata/create" do
1578     setup do
1579       object = insert(:note)
1580       user = User.get_by_ap_id(object.data["actor"])
1581       %{object: object, user: user}
1582     end
1583
1584     test "it returns :forbidden status on attempt to modify someone else's upload", %{
1585       conn: conn,
1586       object: object
1587     } do
1588       initial_description = object.data["name"]
1589       another_user = insert(:user)
1590
1591       conn
1592       |> assign(:user, another_user)
1593       |> post("/api/media/metadata/create", %{"media_id" => object.id})
1594       |> json_response(:forbidden)
1595
1596       object = Repo.get(Object, object.id)
1597       assert object.data["name"] == initial_description
1598     end
1599
1600     test "it updates `data[name]` of referenced Object with provided value", %{
1601       conn: conn,
1602       object: object,
1603       user: user
1604     } do
1605       description = "Informative description of the image. Initial value: #{object.data["name"]}}"
1606
1607       conn
1608       |> assign(:user, user)
1609       |> post("/api/media/metadata/create", %{
1610         "media_id" => object.id,
1611         "alt_text" => %{"text" => description}
1612       })
1613       |> json_response(:no_content)
1614
1615       object = Repo.get(Object, object.id)
1616       assert object.data["name"] == description
1617     end
1618   end
1619 end