git.squeep.com Git - akkoma/blob - test/pleroma/web/activity_pub/activity_pub_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
   6   use Pleroma.Web.ConnCase
   7   use Oban.Testing, repo: Pleroma.Repo
   8
   9   alias Pleroma.Activity
  10   alias Pleroma.Delivery
  11   alias Pleroma.Instances
  12   alias Pleroma.Object
  13   alias Pleroma.Tests.ObanHelpers
  14   alias Pleroma.User
  15   alias Pleroma.Web.ActivityPub.ActivityPub
  16   alias Pleroma.Web.ActivityPub.ObjectView
  17   alias Pleroma.Web.ActivityPub.Relay
  18   alias Pleroma.Web.ActivityPub.UserView
  19   alias Pleroma.Web.ActivityPub.Utils
  20   alias Pleroma.Web.CommonAPI
  21   alias Pleroma.Web.Endpoint
  22   alias Pleroma.Workers.ReceiverWorker
  23
  24   import Pleroma.Factory
  25
  26   require Pleroma.Constants
  27
  28   setup_all do
  29     Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
  30     :ok
  31   end
  32
  33   setup do: clear_config([:instance, :federating], true)
  34
  35   describe "/relay" do
  36     setup do: clear_config([:instance, :allow_relay])
  37
  38     test "with the relay active, it returns the relay user", %{conn: conn} do
  39       res =
  40         conn
  41         |> get(activity_pub_path(conn, :relay))
  42         |> json_response(200)
  43
  44       assert res["id"] =~ "/relay"
  45     end
  46
  47     test "with the relay disabled, it returns 404", %{conn: conn} do
  48       clear_config([:instance, :allow_relay], false)
  49
  50       conn
  51       |> get(activity_pub_path(conn, :relay))
  52       |> json_response(404)
  53     end
  54
  55     test "on non-federating instance, it returns 404", %{conn: conn} do
  56       clear_config([:instance, :federating], false)
  57       user = insert(:user)
  58
  59       conn
  60       |> assign(:user, user)
  61       |> get(activity_pub_path(conn, :relay))
  62       |> json_response(404)
  63     end
  64   end
  65
  66   describe "/internal/fetch" do
  67     test "it returns the internal fetch user", %{conn: conn} do
  68       res =
  69         conn
  70         |> get(activity_pub_path(conn, :internal_fetch))
  71         |> json_response(200)
  72
  73       assert res["id"] =~ "/fetch"
  74     end
  75
  76     test "on non-federating instance, it returns 404", %{conn: conn} do
  77       clear_config([:instance, :federating], false)
  78       user = insert(:user)
  79
  80       conn
  81       |> assign(:user, user)
  82       |> get(activity_pub_path(conn, :internal_fetch))
  83       |> json_response(404)
  84     end
  85   end
  86
  87   describe "/users/:nickname" do
  88     test "it returns a json representation of the user with accept application/json", %{
  89       conn: conn
  90     } do
  91       user = insert(:user)
  92
  93       conn =
  94         conn
  95         |> put_req_header("accept", "application/json")
  96         |> get("/users/#{user.nickname}")
  97
  98       user = User.get_cached_by_id(user.id)
  99
 100       assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
 101     end
 102
 103     test "it returns a json representation of the user with accept application/activity+json", %{
 104       conn: conn
 105     } do
 106       user = insert(:user)
 107
 108       conn =
 109         conn
 110         |> put_req_header("accept", "application/activity+json")
 111         |> get("/users/#{user.nickname}")
 112
 113       user = User.get_cached_by_id(user.id)
 114
 115       assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
 116     end
 117
 118     test "it returns a json representation of the user with accept application/ld+json", %{
 119       conn: conn
 120     } do
 121       user = insert(:user)
 122
 123       conn =
 124         conn
 125         |> put_req_header(
 126           "accept",
 127           "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
 128         )
 129         |> get("/users/#{user.nickname}")
 130
 131       user = User.get_cached_by_id(user.id)
 132
 133       assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
 134     end
 135
 136     test "it returns 404 for remote users", %{
 137       conn: conn
 138     } do
 139       user = insert(:user, local: false, nickname: "remoteuser@example.com")
 140
 141       conn =
 142         conn
 143         |> put_req_header("accept", "application/json")
 144         |> get("/users/#{user.nickname}.json")
 145
 146       assert json_response(conn, 404)
 147     end
 148
 149     test "it returns error when user is not found", %{conn: conn} do
 150       response =
 151         conn
 152         |> put_req_header("accept", "application/json")
 153         |> get("/users/jimm")
 154         |> json_response(404)
 155
 156       assert response == "Not found"
 157     end
 158   end
 159
 160   describe "mastodon compatibility routes" do
 161     test "it returns a json representation of the object with accept application/json", %{
 162       conn: conn
 163     } do
 164       {:ok, object} =
 165         %{
 166           "type" => "Note",
 167           "content" => "hey",
 168           "id" => Endpoint.url() <> "/users/raymoo/statuses/999999999",
 169           "actor" => Endpoint.url() <> "/users/raymoo",
 170           "to" => [Pleroma.Constants.as_public()]
 171         }
 172         |> Object.create()
 173
 174       conn =
 175         conn
 176         |> put_req_header("accept", "application/json")
 177         |> get("/users/raymoo/statuses/999999999")
 178
 179       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: object})
 180     end
 181
 182     test "it returns a json representation of the activity with accept application/json", %{
 183       conn: conn
 184     } do
 185       {:ok, object} =
 186         %{
 187           "type" => "Note",
 188           "content" => "hey",
 189           "id" => Endpoint.url() <> "/users/raymoo/statuses/999999999",
 190           "actor" => Endpoint.url() <> "/users/raymoo",
 191           "to" => [Pleroma.Constants.as_public()]
 192         }
 193         |> Object.create()
 194
 195       {:ok, activity, _} =
 196         %{
 197           "id" => object.data["id"] <> "/activity",
 198           "type" => "Create",
 199           "object" => object.data["id"],
 200           "actor" => object.data["actor"],
 201           "to" => object.data["to"]
 202         }
 203         |> ActivityPub.persist(local: true)
 204
 205       conn =
 206         conn
 207         |> put_req_header("accept", "application/json")
 208         |> get("/users/raymoo/statuses/999999999/activity")
 209
 210       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: activity})
 211     end
 212   end
 213
 214   describe "/objects/:uuid" do
 215     test "it doesn't return a local-only object", %{conn: conn} do
 216       user = insert(:user)
 217       {:ok, post} = CommonAPI.post(user, %{status: "test", visibility: "local"})
 218
 219       assert Pleroma.Web.ActivityPub.Visibility.is_local_public?(post)
 220
 221       object = Object.normalize(post, fetch: false)
 222       uuid = String.split(object.data["id"], "/") |> List.last()
 223
 224       conn =
 225         conn
 226         |> put_req_header("accept", "application/json")
 227         |> get("/objects/#{uuid}")
 228
 229       assert json_response(conn, 404)
 230     end
 231
 232     test "returns local-only objects when authenticated", %{conn: conn} do
 233       user = insert(:user)
 234       {:ok, post} = CommonAPI.post(user, %{status: "test", visibility: "local"})
 235
 236       assert Pleroma.Web.ActivityPub.Visibility.is_local_public?(post)
 237
 238       object = Object.normalize(post, fetch: false)
 239       uuid = String.split(object.data["id"], "/") |> List.last()
 240
 241       assert response =
 242                conn
 243                |> assign(:user, user)
 244                |> put_req_header("accept", "application/activity+json")
 245                |> get("/objects/#{uuid}")
 246
 247       assert json_response(response, 200) == ObjectView.render("object.json", %{object: object})
 248     end
 249
 250     test "it returns a json representation of the object with accept application/json", %{
 251       conn: conn
 252     } do
 253       note = insert(:note)
 254       uuid = String.split(note.data["id"], "/") |> List.last()
 255
 256       conn =
 257         conn
 258         |> put_req_header("accept", "application/json")
 259         |> get("/objects/#{uuid}")
 260
 261       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
 262     end
 263
 264     test "it returns a json representation of the object with accept application/activity+json",
 265          %{conn: conn} do
 266       note = insert(:note)
 267       uuid = String.split(note.data["id"], "/") |> List.last()
 268
 269       conn =
 270         conn
 271         |> put_req_header("accept", "application/activity+json")
 272         |> get("/objects/#{uuid}")
 273
 274       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
 275     end
 276
 277     test "it returns a json representation of the object with accept application/ld+json", %{
 278       conn: conn
 279     } do
 280       note = insert(:note)
 281       uuid = String.split(note.data["id"], "/") |> List.last()
 282
 283       conn =
 284         conn
 285         |> put_req_header(
 286           "accept",
 287           "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
 288         )
 289         |> get("/objects/#{uuid}")
 290
 291       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
 292     end
 293
 294     test "it returns 404 for non-public messages", %{conn: conn} do
 295       note = insert(:direct_note)
 296       uuid = String.split(note.data["id"], "/") |> List.last()
 297
 298       conn =
 299         conn
 300         |> put_req_header("accept", "application/activity+json")
 301         |> get("/objects/#{uuid}")
 302
 303       assert json_response(conn, 404)
 304     end
 305
 306     test "returns visible non-public messages when authenticated", %{conn: conn} do
 307       note = insert(:direct_note)
 308       uuid = String.split(note.data["id"], "/") |> List.last()
 309       user = User.get_by_ap_id(note.data["actor"])
 310       marisa = insert(:user)
 311
 312       assert conn
 313              |> assign(:user, marisa)
 314              |> put_req_header("accept", "application/activity+json")
 315              |> get("/objects/#{uuid}")
 316              |> json_response(404)
 317
 318       assert response =
 319                conn
 320                |> assign(:user, user)
 321                |> put_req_header("accept", "application/activity+json")
 322                |> get("/objects/#{uuid}")
 323                |> json_response(200)
 324
 325       assert response == ObjectView.render("object.json", %{object: note})
 326     end
 327
 328     test "it returns 404 for tombstone objects", %{conn: conn} do
 329       tombstone = insert(:tombstone)
 330       uuid = String.split(tombstone.data["id"], "/") |> List.last()
 331
 332       conn =
 333         conn
 334         |> put_req_header("accept", "application/activity+json")
 335         |> get("/objects/#{uuid}")
 336
 337       assert json_response(conn, 404)
 338     end
 339
 340     test "it caches a response", %{conn: conn} do
 341       note = insert(:note)
 342       uuid = String.split(note.data["id"], "/") |> List.last()
 343
 344       conn1 =
 345         conn
 346         |> put_req_header("accept", "application/activity+json")
 347         |> get("/objects/#{uuid}")
 348
 349       assert json_response(conn1, :ok)
 350       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 351
 352       conn2 =
 353         conn
 354         |> put_req_header("accept", "application/activity+json")
 355         |> get("/objects/#{uuid}")
 356
 357       assert json_response(conn1, :ok) == json_response(conn2, :ok)
 358       assert Enum.any?(conn2.resp_headers, &(&1 == {"x-cache", "HIT from Pleroma"}))
 359     end
 360
 361     test "cached purged after object deletion", %{conn: conn} do
 362       note = insert(:note)
 363       uuid = String.split(note.data["id"], "/") |> List.last()
 364
 365       conn1 =
 366         conn
 367         |> put_req_header("accept", "application/activity+json")
 368         |> get("/objects/#{uuid}")
 369
 370       assert json_response(conn1, :ok)
 371       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 372
 373       Object.delete(note)
 374
 375       conn2 =
 376         conn
 377         |> put_req_header("accept", "application/activity+json")
 378         |> get("/objects/#{uuid}")
 379
 380       assert "Not found" == json_response(conn2, :not_found)
 381     end
 382   end
 383
 384   describe "/activities/:uuid" do
 385     test "it doesn't return a local-only activity", %{conn: conn} do
 386       user = insert(:user)
 387       {:ok, post} = CommonAPI.post(user, %{status: "test", visibility: "local"})
 388
 389       assert Pleroma.Web.ActivityPub.Visibility.is_local_public?(post)
 390
 391       uuid = String.split(post.data["id"], "/") |> List.last()
 392
 393       conn =
 394         conn
 395         |> put_req_header("accept", "application/json")
 396         |> get("/activities/#{uuid}")
 397
 398       assert json_response(conn, 404)
 399     end
 400
 401     test "returns local-only activities when authenticated", %{conn: conn} do
 402       user = insert(:user)
 403       {:ok, post} = CommonAPI.post(user, %{status: "test", visibility: "local"})
 404
 405       assert Pleroma.Web.ActivityPub.Visibility.is_local_public?(post)
 406
 407       uuid = String.split(post.data["id"], "/") |> List.last()
 408
 409       assert response =
 410                conn
 411                |> assign(:user, user)
 412                |> put_req_header("accept", "application/activity+json")
 413                |> get("/activities/#{uuid}")
 414
 415       assert json_response(response, 200) == ObjectView.render("object.json", %{object: post})
 416     end
 417
 418     test "it returns a json representation of the activity", %{conn: conn} do
 419       activity = insert(:note_activity)
 420       uuid = String.split(activity.data["id"], "/") |> List.last()
 421
 422       conn =
 423         conn
 424         |> put_req_header("accept", "application/activity+json")
 425         |> get("/activities/#{uuid}")
 426
 427       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: activity})
 428     end
 429
 430     test "it returns 404 for non-public activities", %{conn: conn} do
 431       activity = insert(:direct_note_activity)
 432       uuid = String.split(activity.data["id"], "/") |> List.last()
 433
 434       conn =
 435         conn
 436         |> put_req_header("accept", "application/activity+json")
 437         |> get("/activities/#{uuid}")
 438
 439       assert json_response(conn, 404)
 440     end
 441
 442     test "returns visible non-public messages when authenticated", %{conn: conn} do
 443       note = insert(:direct_note_activity)
 444       uuid = String.split(note.data["id"], "/") |> List.last()
 445       user = User.get_by_ap_id(note.data["actor"])
 446       marisa = insert(:user)
 447
 448       assert conn
 449              |> assign(:user, marisa)
 450              |> put_req_header("accept", "application/activity+json")
 451              |> get("/activities/#{uuid}")
 452              |> json_response(404)
 453
 454       assert response =
 455                conn
 456                |> assign(:user, user)
 457                |> put_req_header("accept", "application/activity+json")
 458                |> get("/activities/#{uuid}")
 459                |> json_response(200)
 460
 461       assert response == ObjectView.render("object.json", %{object: note})
 462     end
 463
 464     test "it caches a response", %{conn: conn} do
 465       activity = insert(:note_activity)
 466       uuid = String.split(activity.data["id"], "/") |> List.last()
 467
 468       conn1 =
 469         conn
 470         |> put_req_header("accept", "application/activity+json")
 471         |> get("/activities/#{uuid}")
 472
 473       assert json_response(conn1, :ok)
 474       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 475
 476       conn2 =
 477         conn
 478         |> put_req_header("accept", "application/activity+json")
 479         |> get("/activities/#{uuid}")
 480
 481       assert json_response(conn1, :ok) == json_response(conn2, :ok)
 482       assert Enum.any?(conn2.resp_headers, &(&1 == {"x-cache", "HIT from Pleroma"}))
 483     end
 484
 485     test "cached purged after activity deletion", %{conn: conn} do
 486       user = insert(:user)
 487       {:ok, activity} = CommonAPI.post(user, %{status: "cofe"})
 488
 489       uuid = String.split(activity.data["id"], "/") |> List.last()
 490
 491       conn1 =
 492         conn
 493         |> put_req_header("accept", "application/activity+json")
 494         |> get("/activities/#{uuid}")
 495
 496       assert json_response(conn1, :ok)
 497       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 498
 499       Activity.delete_all_by_object_ap_id(activity.object.data["id"])
 500
 501       conn2 =
 502         conn
 503         |> put_req_header("accept", "application/activity+json")
 504         |> get("/activities/#{uuid}")
 505
 506       assert "Not found" == json_response(conn2, :not_found)
 507     end
 508   end
 509
 510   describe "/inbox" do
 511     test "it inserts an incoming activity into the database", %{conn: conn} do
 512       data = File.read!("test/fixtures/mastodon-post-activity.json") |> Jason.decode!()
 513
 514       conn =
 515         conn
 516         |> assign(:valid_signature, true)
 517         |> put_req_header("content-type", "application/activity+json")
 518         |> post("/inbox", data)
 519
 520       assert "ok" == json_response(conn, 200)
 521
 522       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 523       assert Activity.get_by_ap_id(data["id"])
 524     end
 525
 526     @tag capture_log: true
 527     test "it inserts an incoming activity into the database" <>
 528            "even if we can't fetch the user but have it in our db",
 529          %{conn: conn} do
 530       user =
 531         insert(:user,
 532           ap_id: "https://mastodon.example.org/users/raymoo",
 533           ap_enabled: true,
 534           local: false,
 535           last_refreshed_at: nil
 536         )
 537
 538       data =
 539         File.read!("test/fixtures/mastodon-post-activity.json")
 540         |> Jason.decode!()
 541         |> Map.put("actor", user.ap_id)
 542         |> put_in(["object", "attridbutedTo"], user.ap_id)
 543
 544       conn =
 545         conn
 546         |> assign(:valid_signature, true)
 547         |> put_req_header("content-type", "application/activity+json")
 548         |> post("/inbox", data)
 549
 550       assert "ok" == json_response(conn, 200)
 551
 552       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 553       assert Activity.get_by_ap_id(data["id"])
 554     end
 555
 556     test "it clears `unreachable` federation status of the sender", %{conn: conn} do
 557       data = File.read!("test/fixtures/mastodon-post-activity.json") |> Jason.decode!()
 558
 559       sender_url = data["actor"]
 560       Instances.set_consistently_unreachable(sender_url)
 561       refute Instances.reachable?(sender_url)
 562
 563       conn =
 564         conn
 565         |> assign(:valid_signature, true)
 566         |> put_req_header("content-type", "application/activity+json")
 567         |> post("/inbox", data)
 568
 569       assert "ok" == json_response(conn, 200)
 570       assert Instances.reachable?(sender_url)
 571     end
 572
 573     test "accept follow activity", %{conn: conn} do
 574       clear_config([:instance, :federating], true)
 575       relay = Relay.get_actor()
 576
 577       assert {:ok, %Activity{} = activity} = Relay.follow("https://relay.mastodon.host/actor")
 578
 579       followed_relay = Pleroma.User.get_by_ap_id("https://relay.mastodon.host/actor")
 580       relay = refresh_record(relay)
 581
 582       accept =
 583         File.read!("test/fixtures/relay/accept-follow.json")
 584         |> String.replace("{{ap_id}}", relay.ap_id)
 585         |> String.replace("{{activity_id}}", activity.data["id"])
 586
 587       assert "ok" ==
 588                conn
 589                |> assign(:valid_signature, true)
 590                |> put_req_header("content-type", "application/activity+json")
 591                |> post("/inbox", accept)
 592                |> json_response(200)
 593
 594       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 595
 596       assert Pleroma.FollowingRelationship.following?(
 597                relay,
 598                followed_relay
 599              )
 600
 601       Mix.shell(Mix.Shell.Process)
 602
 603       on_exit(fn ->
 604         Mix.shell(Mix.Shell.IO)
 605       end)
 606
 607       :ok = Mix.Tasks.Pleroma.Relay.run(["list"])
 608       assert_receive {:mix_shell, :info, ["https://relay.mastodon.host/actor"]}
 609     end
 610
 611     @tag capture_log: true
 612     test "without valid signature, " <>
 613            "it only accepts Create activities and requires enabled federation",
 614          %{conn: conn} do
 615       data = File.read!("test/fixtures/mastodon-post-activity.json") |> Jason.decode!()
 616       non_create_data = File.read!("test/fixtures/mastodon-announce.json") |> Jason.decode!()
 617
 618       conn = put_req_header(conn, "content-type", "application/activity+json")
 619
 620       clear_config([:instance, :federating], false)
 621
 622       conn
 623       |> post("/inbox", data)
 624       |> json_response(403)
 625
 626       conn
 627       |> post("/inbox", non_create_data)
 628       |> json_response(403)
 629
 630       clear_config([:instance, :federating], true)
 631
 632       ret_conn = post(conn, "/inbox", data)
 633       assert "ok" == json_response(ret_conn, 200)
 634
 635       conn
 636       |> post("/inbox", non_create_data)
 637       |> json_response(400)
 638     end
 639   end
 640
 641   describe "/users/:nickname/inbox" do
 642     setup do
 643       data =
 644         File.read!("test/fixtures/mastodon-post-activity.json")
 645         |> Jason.decode!()
 646
 647       [data: data]
 648     end
 649
 650     test "it inserts an incoming activity into the database", %{conn: conn, data: data} do
 651       user = insert(:user)
 652       data = Map.put(data, "bcc", [user.ap_id])
 653
 654       conn =
 655         conn
 656         |> assign(:valid_signature, true)
 657         |> put_req_header("content-type", "application/activity+json")
 658         |> post("/users/#{user.nickname}/inbox", data)
 659
 660       assert "ok" == json_response(conn, 200)
 661       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 662       assert Activity.get_by_ap_id(data["id"])
 663     end
 664
 665     test "it accepts messages with to as string instead of array", %{conn: conn, data: data} do
 666       user = insert(:user)
 667
 668       data =
 669         Map.put(data, "to", user.ap_id)
 670         |> Map.delete("cc")
 671
 672       conn =
 673         conn
 674         |> assign(:valid_signature, true)
 675         |> put_req_header("content-type", "application/activity+json")
 676         |> post("/users/#{user.nickname}/inbox", data)
 677
 678       assert "ok" == json_response(conn, 200)
 679       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 680       assert Activity.get_by_ap_id(data["id"])
 681     end
 682
 683     test "it accepts messages with cc as string instead of array", %{conn: conn, data: data} do
 684       user = insert(:user)
 685
 686       data =
 687         Map.put(data, "cc", user.ap_id)
 688         |> Map.delete("to")
 689
 690       conn =
 691         conn
 692         |> assign(:valid_signature, true)
 693         |> put_req_header("content-type", "application/activity+json")
 694         |> post("/users/#{user.nickname}/inbox", data)
 695
 696       assert "ok" == json_response(conn, 200)
 697       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 698       %Activity{} = activity = Activity.get_by_ap_id(data["id"])
 699       assert user.ap_id in activity.recipients
 700     end
 701
 702     test "it accepts messages with bcc as string instead of array", %{conn: conn, data: data} do
 703       user = insert(:user)
 704
 705       data =
 706         Map.put(data, "bcc", user.ap_id)
 707         |> Map.delete("to")
 708         |> Map.delete("cc")
 709
 710       conn =
 711         conn
 712         |> assign(:valid_signature, true)
 713         |> put_req_header("content-type", "application/activity+json")
 714         |> post("/users/#{user.nickname}/inbox", data)
 715
 716       assert "ok" == json_response(conn, 200)
 717       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 718       assert Activity.get_by_ap_id(data["id"])
 719     end
 720
 721     test "it accepts announces with to as string instead of array", %{conn: conn} do
 722       user = insert(:user)
 723
 724       {:ok, post} = CommonAPI.post(user, %{status: "hey"})
 725       announcer = insert(:user, local: false)
 726
 727       data = %{
 728         "@context" => "https://www.w3.org/ns/activitystreams",
 729         "actor" => announcer.ap_id,
 730         "id" => "#{announcer.ap_id}/statuses/19512778738411822/activity",
 731         "object" => post.data["object"],
 732         "to" => "https://www.w3.org/ns/activitystreams#Public",
 733         "cc" => [user.ap_id],
 734         "type" => "Announce"
 735       }
 736
 737       conn =
 738         conn
 739         |> assign(:valid_signature, true)
 740         |> put_req_header("content-type", "application/activity+json")
 741         |> post("/users/#{user.nickname}/inbox", data)
 742
 743       assert "ok" == json_response(conn, 200)
 744       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 745       %Activity{} = activity = Activity.get_by_ap_id(data["id"])
 746       assert "https://www.w3.org/ns/activitystreams#Public" in activity.recipients
 747     end
 748
 749     test "it accepts messages from actors that are followed by the user", %{
 750       conn: conn,
 751       data: data
 752     } do
 753       recipient = insert(:user)
 754       actor = insert(:user, %{ap_id: "http://mastodon.example.org/users/actor"})
 755
 756       {:ok, recipient, actor} = User.follow(recipient, actor)
 757
 758       object =
 759         data["object"]
 760         |> Map.put("attributedTo", actor.ap_id)
 761
 762       data =
 763         data
 764         |> Map.put("actor", actor.ap_id)
 765         |> Map.put("object", object)
 766
 767       conn =
 768         conn
 769         |> assign(:valid_signature, true)
 770         |> put_req_header("content-type", "application/activity+json")
 771         |> post("/users/#{recipient.nickname}/inbox", data)
 772
 773       assert "ok" == json_response(conn, 200)
 774       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 775       assert Activity.get_by_ap_id(data["id"])
 776     end
 777
 778     test "it rejects reads from other users", %{conn: conn} do
 779       user = insert(:user)
 780       other_user = insert(:user)
 781
 782       conn =
 783         conn
 784         |> assign(:user, other_user)
 785         |> put_req_header("accept", "application/activity+json")
 786         |> get("/users/#{user.nickname}/inbox")
 787
 788       assert json_response(conn, 403)
 789     end
 790
 791     test "it returns a note activity in a collection", %{conn: conn} do
 792       note_activity = insert(:direct_note_activity)
 793       note_object = Object.normalize(note_activity, fetch: false)
 794       user = User.get_cached_by_ap_id(hd(note_activity.data["to"]))
 795
 796       conn =
 797         conn
 798         |> assign(:user, user)
 799         |> put_req_header("accept", "application/activity+json")
 800         |> get("/users/#{user.nickname}/inbox?page=true")
 801
 802       assert response(conn, 200) =~ note_object.data["content"]
 803     end
 804
 805     test "it clears `unreachable` federation status of the sender", %{conn: conn, data: data} do
 806       user = insert(:user)
 807       data = Map.put(data, "bcc", [user.ap_id])
 808
 809       sender_host = URI.parse(data["actor"]).host
 810       Instances.set_consistently_unreachable(sender_host)
 811       refute Instances.reachable?(sender_host)
 812
 813       conn =
 814         conn
 815         |> assign(:valid_signature, true)
 816         |> put_req_header("content-type", "application/activity+json")
 817         |> post("/users/#{user.nickname}/inbox", data)
 818
 819       assert "ok" == json_response(conn, 200)
 820       assert Instances.reachable?(sender_host)
 821     end
 822
 823     test "it removes all follower collections but actor's", %{conn: conn} do
 824       [actor, recipient] = insert_pair(:user)
 825
 826       data =
 827         File.read!("test/fixtures/activitypub-client-post-activity.json")
 828         |> Jason.decode!()
 829
 830       object = Map.put(data["object"], "attributedTo", actor.ap_id)
 831
 832       data =
 833         data
 834         |> Map.put("id", Utils.generate_object_id())
 835         |> Map.put("actor", actor.ap_id)
 836         |> Map.put("object", object)
 837         |> Map.put("cc", [
 838           recipient.follower_address,
 839           actor.follower_address
 840         ])
 841         |> Map.put("to", [
 842           recipient.ap_id,
 843           recipient.follower_address,
 844           "https://www.w3.org/ns/activitystreams#Public"
 845         ])
 846
 847       conn
 848       |> assign(:valid_signature, true)
 849       |> put_req_header("content-type", "application/activity+json")
 850       |> post("/users/#{recipient.nickname}/inbox", data)
 851       |> json_response(200)
 852
 853       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 854
 855       activity = Activity.get_by_ap_id(data["id"])
 856
 857       assert activity.id
 858       assert actor.follower_address in activity.recipients
 859       assert actor.follower_address in activity.data["cc"]
 860
 861       refute recipient.follower_address in activity.recipients
 862       refute recipient.follower_address in activity.data["cc"]
 863       refute recipient.follower_address in activity.data["to"]
 864     end
 865
 866     test "it requires authentication", %{conn: conn} do
 867       user = insert(:user)
 868       conn = put_req_header(conn, "accept", "application/activity+json")
 869
 870       ret_conn = get(conn, "/users/#{user.nickname}/inbox")
 871       assert json_response(ret_conn, 403)
 872
 873       ret_conn =
 874         conn
 875         |> assign(:user, user)
 876         |> get("/users/#{user.nickname}/inbox")
 877
 878       assert json_response(ret_conn, 200)
 879     end
 880
 881     @tag capture_log: true
 882     test "forwarded report", %{conn: conn} do
 883       admin = insert(:user, is_admin: true)
 884       actor = insert(:user, local: false)
 885       remote_domain = URI.parse(actor.ap_id).host
 886       reported_user = insert(:user)
 887
 888       note = insert(:note_activity, user: reported_user)
 889
 890       data = %{
 891         "@context" => [
 892           "https://www.w3.org/ns/activitystreams",
 893           "https://#{remote_domain}/schemas/litepub-0.1.jsonld",
 894           %{
 895             "@language" => "und"
 896           }
 897         ],
 898         "actor" => actor.ap_id,
 899         "cc" => [
 900           reported_user.ap_id
 901         ],
 902         "content" => "test",
 903         "context" => "context",
 904         "id" => "http://#{remote_domain}/activities/02be56cf-35e3-46b4-b2c6-47ae08dfee9e",
 905         "nickname" => reported_user.nickname,
 906         "object" => [
 907           reported_user.ap_id,
 908           %{
 909             "actor" => %{
 910               "actor_type" => "Person",
 911               "approval_pending" => false,
 912               "avatar" => "",
 913               "confirmation_pending" => false,
 914               "deactivated" => false,
 915               "display_name" => "test user",
 916               "id" => reported_user.id,
 917               "local" => false,
 918               "nickname" => reported_user.nickname,
 919               "registration_reason" => nil,
 920               "roles" => %{
 921                 "admin" => false,
 922                 "moderator" => false
 923               },
 924               "tags" => [],
 925               "url" => reported_user.ap_id
 926             },
 927             "content" => "",
 928             "id" => note.data["id"],
 929             "published" => note.data["published"],
 930             "type" => "Note"
 931           }
 932         ],
 933         "published" => note.data["published"],
 934         "state" => "open",
 935         "to" => [],
 936         "type" => "Flag"
 937       }
 938
 939       conn
 940       |> assign(:valid_signature, true)
 941       |> put_req_header("content-type", "application/activity+json")
 942       |> post("/users/#{reported_user.nickname}/inbox", data)
 943       |> json_response(200)
 944
 945       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 946
 947       assert Pleroma.Repo.aggregate(Activity, :count, :id) == 2
 948
 949       ObanHelpers.perform_all()
 950
 951       Swoosh.TestAssertions.assert_email_sent(
 952         to: {admin.name, admin.email},
 953         html_body: ~r/Reported Account:/i
 954       )
 955     end
 956
 957     @tag capture_log: true
 958     test "forwarded report from mastodon", %{conn: conn} do
 959       admin = insert(:user, is_admin: true)
 960       actor = insert(:user, local: false)
 961       remote_domain = URI.parse(actor.ap_id).host
 962       remote_actor = "https://#{remote_domain}/actor"
 963       [reported_user, another] = insert_list(2, :user)
 964
 965       note = insert(:note_activity, user: reported_user)
 966
 967       Pleroma.Web.CommonAPI.favorite(another, note.id)
 968
 969       mock_json_body =
 970         "test/fixtures/mastodon/application_actor.json"
 971         |> File.read!()
 972         |> String.replace("{{DOMAIN}}", remote_domain)
 973
 974       Tesla.Mock.mock(fn %{url: ^remote_actor} ->
 975         %Tesla.Env{
 976           status: 200,
 977           body: mock_json_body,
 978           headers: [{"content-type", "application/activity+json"}]
 979         }
 980       end)
 981
 982       data = %{
 983         "@context" => "https://www.w3.org/ns/activitystreams",
 984         "actor" => remote_actor,
 985         "content" => "test report",
 986         "id" => "https://#{remote_domain}/e3b12fd1-948c-446e-b93b-a5e67edbe1d8",
 987         "nickname" => reported_user.nickname,
 988         "object" => [
 989           reported_user.ap_id,
 990           note.data["object"]
 991         ],
 992         "type" => "Flag"
 993       }
 994
 995       conn
 996       |> assign(:valid_signature, true)
 997       |> put_req_header("content-type", "application/activity+json")
 998       |> post("/users/#{reported_user.nickname}/inbox", data)
 999       |> json_response(200)
1000
1001       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
1002
1003       flag_activity = "Flag" |> Pleroma.Activity.Queries.by_type() |> Pleroma.Repo.one()
1004       reported_user_ap_id = reported_user.ap_id
1005
1006       [^reported_user_ap_id, flag_data] = flag_activity.data["object"]
1007
1008       Enum.each(~w(actor content id published type), &Map.has_key?(flag_data, &1))
1009       ObanHelpers.perform_all()
1010
1011       Swoosh.TestAssertions.assert_email_sent(
1012         to: {admin.name, admin.email},
1013         html_body: ~r/#{note.data["object"]}/i
1014       )
1015     end
1016   end
1017
1018   describe "GET /users/:nickname/outbox" do
1019     test "it paginates correctly", %{conn: conn} do
1020       user = insert(:user)
1021       conn = assign(conn, :user, user)
1022       outbox_endpoint = user.ap_id <> "/outbox"
1023
1024       _posts =
1025         for i <- 0..25 do
1026           {:ok, activity} = CommonAPI.post(user, %{status: "post #{i}"})
1027           activity
1028         end
1029
1030       result =
1031         conn
1032         |> put_req_header("accept", "application/activity+json")
1033         |> get(outbox_endpoint <> "?page=true")
1034         |> json_response(200)
1035
1036       result_ids = Enum.map(result["orderedItems"], fn x -> x["id"] end)
1037       assert length(result["orderedItems"]) == 20
1038       assert length(result_ids) == 20
1039       assert result["next"]
1040       assert String.starts_with?(result["next"], outbox_endpoint)
1041
1042       result_next =
1043         conn
1044         |> put_req_header("accept", "application/activity+json")
1045         |> get(result["next"])
1046         |> json_response(200)
1047
1048       result_next_ids = Enum.map(result_next["orderedItems"], fn x -> x["id"] end)
1049       assert length(result_next["orderedItems"]) == 6
1050       assert length(result_next_ids) == 6
1051       refute Enum.find(result_next_ids, fn x -> x in result_ids end)
1052       refute Enum.find(result_ids, fn x -> x in result_next_ids end)
1053       assert String.starts_with?(result["id"], outbox_endpoint)
1054
1055       result_next_again =
1056         conn
1057         |> put_req_header("accept", "application/activity+json")
1058         |> get(result_next["id"])
1059         |> json_response(200)
1060
1061       assert result_next == result_next_again
1062     end
1063
1064     test "it returns 200 even if there're no activities", %{conn: conn} do
1065       user = insert(:user)
1066       outbox_endpoint = user.ap_id <> "/outbox"
1067
1068       conn =
1069         conn
1070         |> assign(:user, user)
1071         |> put_req_header("accept", "application/activity+json")
1072         |> get(outbox_endpoint)
1073
1074       result = json_response(conn, 200)
1075       assert outbox_endpoint == result["id"]
1076     end
1077
1078     test "it returns a note activity in a collection", %{conn: conn} do
1079       note_activity = insert(:note_activity)
1080       note_object = Object.normalize(note_activity, fetch: false)
1081       user = User.get_cached_by_ap_id(note_activity.data["actor"])
1082
1083       conn =
1084         conn
1085         |> assign(:user, user)
1086         |> put_req_header("accept", "application/activity+json")
1087         |> get("/users/#{user.nickname}/outbox?page=true")
1088
1089       assert response(conn, 200) =~ note_object.data["content"]
1090     end
1091
1092     test "it returns an announce activity in a collection", %{conn: conn} do
1093       announce_activity = insert(:announce_activity)
1094       user = User.get_cached_by_ap_id(announce_activity.data["actor"])
1095
1096       conn =
1097         conn
1098         |> assign(:user, user)
1099         |> put_req_header("accept", "application/activity+json")
1100         |> get("/users/#{user.nickname}/outbox?page=true")
1101
1102       assert response(conn, 200) =~ announce_activity.data["object"]
1103     end
1104   end
1105
1106   describe "POST /users/:nickname/outbox (C2S)" do
1107     setup do: clear_config([:instance, :limit])
1108
1109     setup do
1110       [
1111         activity: %{
1112           "@context" => "https://www.w3.org/ns/activitystreams",
1113           "type" => "Create",
1114           "object" => %{"type" => "Note", "content" => "AP C2S test"},
1115           "to" => "https://www.w3.org/ns/activitystreams#Public",
1116           "cc" => []
1117         }
1118       ]
1119     end
1120
1121     test "it rejects posts from other users / unauthenticated users", %{
1122       conn: conn,
1123       activity: activity
1124     } do
1125       user = insert(:user)
1126       other_user = insert(:user)
1127       conn = put_req_header(conn, "content-type", "application/activity+json")
1128
1129       conn
1130       |> post("/users/#{user.nickname}/outbox", activity)
1131       |> json_response(403)
1132
1133       conn
1134       |> assign(:user, other_user)
1135       |> post("/users/#{user.nickname}/outbox", activity)
1136       |> json_response(403)
1137     end
1138
1139     test "it inserts an incoming create activity into the database", %{
1140       conn: conn,
1141       activity: activity
1142     } do
1143       user = insert(:user)
1144
1145       result =
1146         conn
1147         |> assign(:user, user)
1148         |> put_req_header("content-type", "application/activity+json")
1149         |> post("/users/#{user.nickname}/outbox", activity)
1150         |> json_response(201)
1151
1152       assert Activity.get_by_ap_id(result["id"])
1153       assert result["object"]
1154       assert %Object{data: object} = Object.normalize(result["object"], fetch: false)
1155       assert object["content"] == activity["object"]["content"]
1156     end
1157
1158     test "it rejects anything beyond 'Note' creations", %{conn: conn, activity: activity} do
1159       user = insert(:user)
1160
1161       activity =
1162         activity
1163         |> put_in(["object", "type"], "Benis")
1164
1165       _result =
1166         conn
1167         |> assign(:user, user)
1168         |> put_req_header("content-type", "application/activity+json")
1169         |> post("/users/#{user.nickname}/outbox", activity)
1170         |> json_response(400)
1171     end
1172
1173     test "it inserts an incoming sensitive activity into the database", %{
1174       conn: conn,
1175       activity: activity
1176     } do
1177       user = insert(:user)
1178       conn = assign(conn, :user, user)
1179       object = Map.put(activity["object"], "sensitive", true)
1180       activity = Map.put(activity, "object", object)
1181
1182       response =
1183         conn
1184         |> put_req_header("content-type", "application/activity+json")
1185         |> post("/users/#{user.nickname}/outbox", activity)
1186         |> json_response(201)
1187
1188       assert Activity.get_by_ap_id(response["id"])
1189       assert response["object"]
1190       assert %Object{data: response_object} = Object.normalize(response["object"], fetch: false)
1191       assert response_object["sensitive"] == true
1192       assert response_object["content"] == activity["object"]["content"]
1193
1194       representation =
1195         conn
1196         |> put_req_header("accept", "application/activity+json")
1197         |> get(response["id"])
1198         |> json_response(200)
1199
1200       assert representation["object"]["sensitive"] == true
1201     end
1202
1203     test "it rejects an incoming activity with bogus type", %{conn: conn, activity: activity} do
1204       user = insert(:user)
1205       activity = Map.put(activity, "type", "BadType")
1206
1207       conn =
1208         conn
1209         |> assign(:user, user)
1210         |> put_req_header("content-type", "application/activity+json")
1211         |> post("/users/#{user.nickname}/outbox", activity)
1212
1213       assert json_response(conn, 400)
1214     end
1215
1216     test "it erects a tombstone when receiving a delete activity", %{conn: conn} do
1217       note_activity = insert(:note_activity)
1218       note_object = Object.normalize(note_activity, fetch: false)
1219       user = User.get_cached_by_ap_id(note_activity.data["actor"])
1220
1221       data = %{
1222         type: "Delete",
1223         object: %{
1224           id: note_object.data["id"]
1225         }
1226       }
1227
1228       conn =
1229         conn
1230         |> assign(:user, user)
1231         |> put_req_header("content-type", "application/activity+json")
1232         |> post("/users/#{user.nickname}/outbox", data)
1233
1234       result = json_response(conn, 201)
1235       assert Activity.get_by_ap_id(result["id"])
1236
1237       assert object = Object.get_by_ap_id(note_object.data["id"])
1238       assert object.data["type"] == "Tombstone"
1239     end
1240
1241     test "it rejects delete activity of object from other actor", %{conn: conn} do
1242       note_activity = insert(:note_activity)
1243       note_object = Object.normalize(note_activity, fetch: false)
1244       user = insert(:user)
1245
1246       data = %{
1247         type: "Delete",
1248         object: %{
1249           id: note_object.data["id"]
1250         }
1251       }
1252
1253       conn =
1254         conn
1255         |> assign(:user, user)
1256         |> put_req_header("content-type", "application/activity+json")
1257         |> post("/users/#{user.nickname}/outbox", data)
1258
1259       assert json_response(conn, 400)
1260     end
1261
1262     test "it increases like count when receiving a like action", %{conn: conn} do
1263       note_activity = insert(:note_activity)
1264       note_object = Object.normalize(note_activity, fetch: false)
1265       user = User.get_cached_by_ap_id(note_activity.data["actor"])
1266
1267       data = %{
1268         type: "Like",
1269         object: %{
1270           id: note_object.data["id"]
1271         }
1272       }
1273
1274       conn =
1275         conn
1276         |> assign(:user, user)
1277         |> put_req_header("content-type", "application/activity+json")
1278         |> post("/users/#{user.nickname}/outbox", data)
1279
1280       result = json_response(conn, 201)
1281       assert Activity.get_by_ap_id(result["id"])
1282
1283       assert object = Object.get_by_ap_id(note_object.data["id"])
1284       assert object.data["like_count"] == 1
1285     end
1286
1287     test "it doesn't spreads faulty attributedTo or actor fields", %{
1288       conn: conn,
1289       activity: activity
1290     } do
1291       reimu = insert(:user, nickname: "reimu")
1292       cirno = insert(:user, nickname: "cirno")
1293
1294       assert reimu.ap_id
1295       assert cirno.ap_id
1296
1297       activity =
1298         activity
1299         |> put_in(["object", "actor"], reimu.ap_id)
1300         |> put_in(["object", "attributedTo"], reimu.ap_id)
1301         |> put_in(["actor"], reimu.ap_id)
1302         |> put_in(["attributedTo"], reimu.ap_id)
1303
1304       _reimu_outbox =
1305         conn
1306         |> assign(:user, cirno)
1307         |> put_req_header("content-type", "application/activity+json")
1308         |> post("/users/#{reimu.nickname}/outbox", activity)
1309         |> json_response(403)
1310
1311       cirno_outbox =
1312         conn
1313         |> assign(:user, cirno)
1314         |> put_req_header("content-type", "application/activity+json")
1315         |> post("/users/#{cirno.nickname}/outbox", activity)
1316         |> json_response(201)
1317
1318       assert cirno_outbox["attributedTo"] == nil
1319       assert cirno_outbox["actor"] == cirno.ap_id
1320
1321       assert cirno_object = Object.normalize(cirno_outbox["object"], fetch: false)
1322       assert cirno_object.data["actor"] == cirno.ap_id
1323       assert cirno_object.data["attributedTo"] == cirno.ap_id
1324     end
1325
1326     test "Character limitation", %{conn: conn, activity: activity} do
1327       clear_config([:instance, :limit], 5)
1328       user = insert(:user)
1329
1330       result =
1331         conn
1332         |> assign(:user, user)
1333         |> put_req_header("content-type", "application/activity+json")
1334         |> post("/users/#{user.nickname}/outbox", activity)
1335         |> json_response(400)
1336
1337       assert result == "Note is over the character limit"
1338     end
1339   end
1340
1341   describe "/relay/followers" do
1342     test "it returns relay followers", %{conn: conn} do
1343       relay_actor = Relay.get_actor()
1344       user = insert(:user)
1345       User.follow(user, relay_actor)
1346
1347       result =
1348         conn
1349         |> get("/relay/followers")
1350         |> json_response(200)
1351
1352       assert result["first"]["orderedItems"] == [user.ap_id]
1353     end
1354
1355     test "on non-federating instance, it returns 404", %{conn: conn} do
1356       clear_config([:instance, :federating], false)
1357       user = insert(:user)
1358
1359       conn
1360       |> assign(:user, user)
1361       |> get("/relay/followers")
1362       |> json_response(404)
1363     end
1364   end
1365
1366   describe "/relay/following" do
1367     test "it returns relay following", %{conn: conn} do
1368       result =
1369         conn
1370         |> get("/relay/following")
1371         |> json_response(200)
1372
1373       assert result["first"]["orderedItems"] == []
1374     end
1375
1376     test "on non-federating instance, it returns 404", %{conn: conn} do
1377       clear_config([:instance, :federating], false)
1378       user = insert(:user)
1379
1380       conn
1381       |> assign(:user, user)
1382       |> get("/relay/following")
1383       |> json_response(404)
1384     end
1385   end
1386
1387   describe "/users/:nickname/followers" do
1388     test "it returns the followers in a collection", %{conn: conn} do
1389       user = insert(:user)
1390       user_two = insert(:user)
1391       User.follow(user, user_two)
1392
1393       result =
1394         conn
1395         |> assign(:user, user_two)
1396         |> get("/users/#{user_two.nickname}/followers")
1397         |> json_response(200)
1398
1399       assert result["first"]["orderedItems"] == [user.ap_id]
1400     end
1401
1402     test "it returns a uri if the user has 'hide_followers' set", %{conn: conn} do
1403       user = insert(:user)
1404       user_two = insert(:user, hide_followers: true)
1405       User.follow(user, user_two)
1406
1407       result =
1408         conn
1409         |> assign(:user, user)
1410         |> get("/users/#{user_two.nickname}/followers")
1411         |> json_response(200)
1412
1413       assert is_binary(result["first"])
1414     end
1415
1416     test "it returns a 403 error on pages, if the user has 'hide_followers' set and the request is from another user",
1417          %{conn: conn} do
1418       user = insert(:user)
1419       other_user = insert(:user, hide_followers: true)
1420
1421       result =
1422         conn
1423         |> assign(:user, user)
1424         |> get("/users/#{other_user.nickname}/followers?page=1")
1425
1426       assert result.status == 403
1427       assert result.resp_body == ""
1428     end
1429
1430     test "it renders the page, if the user has 'hide_followers' set and the request is authenticated with the same user",
1431          %{conn: conn} do
1432       user = insert(:user, hide_followers: true)
1433       other_user = insert(:user)
1434       {:ok, _other_user, user, _activity} = CommonAPI.follow(other_user, user)
1435
1436       result =
1437         conn
1438         |> assign(:user, user)
1439         |> get("/users/#{user.nickname}/followers?page=1")
1440         |> json_response(200)
1441
1442       assert result["totalItems"] == 1
1443       assert result["orderedItems"] == [other_user.ap_id]
1444     end
1445
1446     test "it works for more than 10 users", %{conn: conn} do
1447       user = insert(:user)
1448
1449       Enum.each(1..15, fn _ ->
1450         other_user = insert(:user)
1451         User.follow(other_user, user)
1452       end)
1453
1454       result =
1455         conn
1456         |> assign(:user, user)
1457         |> get("/users/#{user.nickname}/followers")
1458         |> json_response(200)
1459
1460       assert length(result["first"]["orderedItems"]) == 10
1461       assert result["first"]["totalItems"] == 15
1462       assert result["totalItems"] == 15
1463
1464       result =
1465         conn
1466         |> assign(:user, user)
1467         |> get("/users/#{user.nickname}/followers?page=2")
1468         |> json_response(200)
1469
1470       assert length(result["orderedItems"]) == 5
1471       assert result["totalItems"] == 15
1472     end
1473
1474     test "does not require authentication", %{conn: conn} do
1475       user = insert(:user)
1476
1477       conn
1478       |> get("/users/#{user.nickname}/followers")
1479       |> json_response(200)
1480     end
1481   end
1482
1483   describe "/users/:nickname/following" do
1484     test "it returns the following in a collection", %{conn: conn} do
1485       user = insert(:user)
1486       user_two = insert(:user)
1487       User.follow(user, user_two)
1488
1489       result =
1490         conn
1491         |> assign(:user, user)
1492         |> get("/users/#{user.nickname}/following")
1493         |> json_response(200)
1494
1495       assert result["first"]["orderedItems"] == [user_two.ap_id]
1496     end
1497
1498     test "it returns a uri if the user has 'hide_follows' set", %{conn: conn} do
1499       user = insert(:user)
1500       user_two = insert(:user, hide_follows: true)
1501       User.follow(user, user_two)
1502
1503       result =
1504         conn
1505         |> assign(:user, user)
1506         |> get("/users/#{user_two.nickname}/following")
1507         |> json_response(200)
1508
1509       assert is_binary(result["first"])
1510     end
1511
1512     test "it returns a 403 error on pages, if the user has 'hide_follows' set and the request is from another user",
1513          %{conn: conn} do
1514       user = insert(:user)
1515       user_two = insert(:user, hide_follows: true)
1516
1517       result =
1518         conn
1519         |> assign(:user, user)
1520         |> get("/users/#{user_two.nickname}/following?page=1")
1521
1522       assert result.status == 403
1523       assert result.resp_body == ""
1524     end
1525
1526     test "it renders the page, if the user has 'hide_follows' set and the request is authenticated with the same user",
1527          %{conn: conn} do
1528       user = insert(:user, hide_follows: true)
1529       other_user = insert(:user)
1530       {:ok, user, _other_user, _activity} = CommonAPI.follow(user, other_user)
1531
1532       result =
1533         conn
1534         |> assign(:user, user)
1535         |> get("/users/#{user.nickname}/following?page=1")
1536         |> json_response(200)
1537
1538       assert result["totalItems"] == 1
1539       assert result["orderedItems"] == [other_user.ap_id]
1540     end
1541
1542     test "it works for more than 10 users", %{conn: conn} do
1543       user = insert(:user)
1544
1545       Enum.each(1..15, fn _ ->
1546         user = User.get_cached_by_id(user.id)
1547         other_user = insert(:user)
1548         User.follow(user, other_user)
1549       end)
1550
1551       result =
1552         conn
1553         |> assign(:user, user)
1554         |> get("/users/#{user.nickname}/following")
1555         |> json_response(200)
1556
1557       assert length(result["first"]["orderedItems"]) == 10
1558       assert result["first"]["totalItems"] == 15
1559       assert result["totalItems"] == 15
1560
1561       result =
1562         conn
1563         |> assign(:user, user)
1564         |> get("/users/#{user.nickname}/following?page=2")
1565         |> json_response(200)
1566
1567       assert length(result["orderedItems"]) == 5
1568       assert result["totalItems"] == 15
1569     end
1570
1571     test "does not require authentication", %{conn: conn} do
1572       user = insert(:user)
1573
1574       conn
1575       |> get("/users/#{user.nickname}/following")
1576       |> json_response(200)
1577     end
1578   end
1579
1580   describe "delivery tracking" do
1581     test "it tracks a signed object fetch", %{conn: conn} do
1582       user = insert(:user, local: false)
1583       activity = insert(:note_activity)
1584       object = Object.normalize(activity, fetch: false)
1585
1586       object_path = String.trim_leading(object.data["id"], Pleroma.Web.Endpoint.url())
1587
1588       conn
1589       |> put_req_header("accept", "application/activity+json")
1590       |> assign(:user, user)
1591       |> get(object_path)
1592       |> json_response(200)
1593
1594       assert Delivery.get(object.id, user.id)
1595     end
1596
1597     test "it tracks a signed activity fetch", %{conn: conn} do
1598       user = insert(:user, local: false)
1599       activity = insert(:note_activity)
1600       object = Object.normalize(activity, fetch: false)
1601
1602       activity_path = String.trim_leading(activity.data["id"], Pleroma.Web.Endpoint.url())
1603
1604       conn
1605       |> put_req_header("accept", "application/activity+json")
1606       |> assign(:user, user)
1607       |> get(activity_path)
1608       |> json_response(200)
1609
1610       assert Delivery.get(object.id, user.id)
1611     end
1612
1613     test "it tracks a signed object fetch when the json is cached", %{conn: conn} do
1614       user = insert(:user, local: false)
1615       other_user = insert(:user, local: false)
1616       activity = insert(:note_activity)
1617       object = Object.normalize(activity, fetch: false)
1618
1619       object_path = String.trim_leading(object.data["id"], Pleroma.Web.Endpoint.url())
1620
1621       conn
1622       |> put_req_header("accept", "application/activity+json")
1623       |> assign(:user, user)
1624       |> get(object_path)
1625       |> json_response(200)
1626
1627       build_conn()
1628       |> put_req_header("accept", "application/activity+json")
1629       |> assign(:user, other_user)
1630       |> get(object_path)
1631       |> json_response(200)
1632
1633       assert Delivery.get(object.id, user.id)
1634       assert Delivery.get(object.id, other_user.id)
1635     end
1636
1637     test "it tracks a signed activity fetch when the json is cached", %{conn: conn} do
1638       user = insert(:user, local: false)
1639       other_user = insert(:user, local: false)
1640       activity = insert(:note_activity)
1641       object = Object.normalize(activity, fetch: false)
1642
1643       activity_path = String.trim_leading(activity.data["id"], Pleroma.Web.Endpoint.url())
1644
1645       conn
1646       |> put_req_header("accept", "application/activity+json")
1647       |> assign(:user, user)
1648       |> get(activity_path)
1649       |> json_response(200)
1650
1651       build_conn()
1652       |> put_req_header("accept", "application/activity+json")
1653       |> assign(:user, other_user)
1654       |> get(activity_path)
1655       |> json_response(200)
1656
1657       assert Delivery.get(object.id, user.id)
1658       assert Delivery.get(object.id, other_user.id)
1659     end
1660   end
1661
1662   describe "Additional ActivityPub C2S endpoints" do
1663     test "GET /api/ap/whoami", %{conn: conn} do
1664       user = insert(:user)
1665
1666       conn =
1667         conn
1668         |> assign(:user, user)
1669         |> get("/api/ap/whoami")
1670
1671       user = User.get_cached_by_id(user.id)
1672
1673       assert UserView.render("user.json", %{user: user}) == json_response(conn, 200)
1674
1675       conn
1676       |> get("/api/ap/whoami")
1677       |> json_response(403)
1678     end
1679
1680     setup do: clear_config([:media_proxy])
1681     setup do: clear_config([Pleroma.Upload])
1682
1683     test "POST /api/ap/upload_media", %{conn: conn} do
1684       user = insert(:user)
1685
1686       desc = "Description of the image"
1687
1688       image = %Plug.Upload{
1689         content_type: "image/jpeg",
1690         path: Path.absname("test/fixtures/image.jpg"),
1691         filename: "an_image.jpg"
1692       }
1693
1694       object =
1695         conn
1696         |> assign(:user, user)
1697         |> post("/api/ap/upload_media", %{"file" => image, "description" => desc})
1698         |> json_response(:created)
1699
1700       assert object["name"] == desc
1701       assert object["type"] == "Document"
1702       assert object["actor"] == user.ap_id
1703       assert [%{"href" => object_href, "mediaType" => object_mediatype}] = object["url"]
1704       assert is_binary(object_href)
1705       assert object_mediatype == "image/jpeg"
1706       assert String.ends_with?(object_href, ".jpg")
1707
1708       activity_request = %{
1709         "@context" => "https://www.w3.org/ns/activitystreams",
1710         "type" => "Create",
1711         "object" => %{
1712           "type" => "Note",
1713           "content" => "AP C2S test, attachment",
1714           "attachment" => [object]
1715         },
1716         "to" => "https://www.w3.org/ns/activitystreams#Public",
1717         "cc" => []
1718       }
1719
1720       activity_response =
1721         conn
1722         |> assign(:user, user)
1723         |> post("/users/#{user.nickname}/outbox", activity_request)
1724         |> json_response(:created)
1725
1726       assert activity_response["id"]
1727       assert activity_response["object"]
1728       assert activity_response["actor"] == user.ap_id
1729
1730       assert %Object{data: %{"attachment" => [attachment]}} =
1731                Object.normalize(activity_response["object"], fetch: false)
1732
1733       assert attachment["type"] == "Document"
1734       assert attachment["name"] == desc
1735
1736       assert [
1737                %{
1738                  "href" => ^object_href,
1739                  "type" => "Link",
1740                  "mediaType" => ^object_mediatype
1741                }
1742              ] = attachment["url"]
1743
1744       # Fails if unauthenticated
1745       conn
1746       |> post("/api/ap/upload_media", %{"file" => image, "description" => desc})
1747       |> json_response(403)
1748     end
1749   end
1750 end