git.squeep.com Git - akkoma/blob - test/pleroma/web/activity_pub/activity_pub_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
   6   use Pleroma.Web.ConnCase
   7   use Oban.Testing, repo: Pleroma.Repo
   8
   9   alias Pleroma.Activity
  10   alias Pleroma.Delivery
  11   alias Pleroma.Instances
  12   alias Pleroma.Object
  13   alias Pleroma.Tests.ObanHelpers
  14   alias Pleroma.User
  15   alias Pleroma.Web.ActivityPub.ActivityPub
  16   alias Pleroma.Web.ActivityPub.ObjectView
  17   alias Pleroma.Web.ActivityPub.Relay
  18   alias Pleroma.Web.ActivityPub.UserView
  19   alias Pleroma.Web.ActivityPub.Utils
  20   alias Pleroma.Web.CommonAPI
  21   alias Pleroma.Web.Endpoint
  22   alias Pleroma.Workers.ReceiverWorker
  23
  24   import Pleroma.Factory
  25
  26   require Pleroma.Constants
  27
  28   setup_all do
  29     Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
  30     :ok
  31   end
  32
  33   setup do: clear_config([:instance, :federating], true)
  34
  35   describe "/relay" do
  36     setup do: clear_config([:instance, :allow_relay])
  37
  38     test "with the relay active, it returns the relay user", %{conn: conn} do
  39       res =
  40         conn
  41         |> get(activity_pub_path(conn, :relay))
  42         |> json_response(200)
  43
  44       assert res["id"] =~ "/relay"
  45     end
  46
  47     test "with the relay disabled, it returns 404", %{conn: conn} do
  48       clear_config([:instance, :allow_relay], false)
  49
  50       conn
  51       |> get(activity_pub_path(conn, :relay))
  52       |> json_response(404)
  53     end
  54
  55     test "on non-federating instance, it returns 404", %{conn: conn} do
  56       clear_config([:instance, :federating], false)
  57       user = insert(:user)
  58
  59       conn
  60       |> assign(:user, user)
  61       |> get(activity_pub_path(conn, :relay))
  62       |> json_response(404)
  63     end
  64   end
  65
  66   describe "/internal/fetch" do
  67     test "it returns the internal fetch user", %{conn: conn} do
  68       res =
  69         conn
  70         |> get(activity_pub_path(conn, :internal_fetch))
  71         |> json_response(200)
  72
  73       assert res["id"] =~ "/fetch"
  74     end
  75
  76     test "on non-federating instance, it returns 404", %{conn: conn} do
  77       clear_config([:instance, :federating], false)
  78       user = insert(:user)
  79
  80       conn
  81       |> assign(:user, user)
  82       |> get(activity_pub_path(conn, :internal_fetch))
  83       |> json_response(404)
  84     end
  85   end
  86
  87   describe "/users/:nickname" do
  88     test "it returns a json representation of the user with accept application/json", %{
  89       conn: conn
  90     } do
  91       user = insert(:user)
  92
  93       conn =
  94         conn
  95         |> put_req_header("accept", "application/json")
  96         |> get("/users/#{user.nickname}")
  97
  98       user = User.get_cached_by_id(user.id)
  99
 100       assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
 101     end
 102
 103     test "it returns a json representation of the user with accept application/activity+json", %{
 104       conn: conn
 105     } do
 106       user = insert(:user)
 107
 108       conn =
 109         conn
 110         |> put_req_header("accept", "application/activity+json")
 111         |> get("/users/#{user.nickname}")
 112
 113       user = User.get_cached_by_id(user.id)
 114
 115       assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
 116     end
 117
 118     test "it returns a json representation of the user with accept application/ld+json", %{
 119       conn: conn
 120     } do
 121       user = insert(:user)
 122
 123       conn =
 124         conn
 125         |> put_req_header(
 126           "accept",
 127           "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
 128         )
 129         |> get("/users/#{user.nickname}")
 130
 131       user = User.get_cached_by_id(user.id)
 132
 133       assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
 134     end
 135
 136     test "it returns 404 for remote users", %{
 137       conn: conn
 138     } do
 139       user = insert(:user, local: false, nickname: "remoteuser@example.com")
 140
 141       conn =
 142         conn
 143         |> put_req_header("accept", "application/json")
 144         |> get("/users/#{user.nickname}.json")
 145
 146       assert json_response(conn, 404)
 147     end
 148
 149     test "it returns error when user is not found", %{conn: conn} do
 150       response =
 151         conn
 152         |> put_req_header("accept", "application/json")
 153         |> get("/users/jimm")
 154         |> json_response(404)
 155
 156       assert response == "Not found"
 157     end
 158   end
 159
 160   describe "mastodon compatibility routes" do
 161     test "it returns a json representation of the object with accept application/json", %{
 162       conn: conn
 163     } do
 164       {:ok, object} =
 165         %{
 166           "type" => "Note",
 167           "content" => "hey",
 168           "id" => Endpoint.url() <> "/users/raymoo/statuses/999999999",
 169           "actor" => Endpoint.url() <> "/users/raymoo",
 170           "to" => [Pleroma.Constants.as_public()]
 171         }
 172         |> Object.create()
 173
 174       conn =
 175         conn
 176         |> put_req_header("accept", "application/json")
 177         |> get("/users/raymoo/statuses/999999999")
 178
 179       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: object})
 180     end
 181
 182     test "it returns a json representation of the activity with accept application/json", %{
 183       conn: conn
 184     } do
 185       {:ok, object} =
 186         %{
 187           "type" => "Note",
 188           "content" => "hey",
 189           "id" => Endpoint.url() <> "/users/raymoo/statuses/999999999",
 190           "actor" => Endpoint.url() <> "/users/raymoo",
 191           "to" => [Pleroma.Constants.as_public()]
 192         }
 193         |> Object.create()
 194
 195       {:ok, activity, _} =
 196         %{
 197           "id" => object.data["id"] <> "/activity",
 198           "type" => "Create",
 199           "object" => object.data["id"],
 200           "actor" => object.data["actor"],
 201           "to" => object.data["to"]
 202         }
 203         |> ActivityPub.persist(local: true)
 204
 205       conn =
 206         conn
 207         |> put_req_header("accept", "application/json")
 208         |> get("/users/raymoo/statuses/999999999/activity")
 209
 210       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: activity})
 211     end
 212   end
 213
 214   describe "/objects/:uuid" do
 215     test "it doesn't return a local-only object", %{conn: conn} do
 216       user = insert(:user)
 217       {:ok, post} = CommonAPI.post(user, %{status: "test", visibility: "local"})
 218
 219       assert Pleroma.Web.ActivityPub.Visibility.is_local_public?(post)
 220
 221       object = Object.normalize(post, fetch: false)
 222       uuid = String.split(object.data["id"], "/") |> List.last()
 223
 224       conn =
 225         conn
 226         |> put_req_header("accept", "application/json")
 227         |> get("/objects/#{uuid}")
 228
 229       assert json_response(conn, 404)
 230     end
 231
 232     test "returns local-only objects when authenticated", %{conn: conn} do
 233       user = insert(:user)
 234       {:ok, post} = CommonAPI.post(user, %{status: "test", visibility: "local"})
 235
 236       assert Pleroma.Web.ActivityPub.Visibility.is_local_public?(post)
 237
 238       object = Object.normalize(post, fetch: false)
 239       uuid = String.split(object.data["id"], "/") |> List.last()
 240
 241       assert response =
 242                conn
 243                |> assign(:user, user)
 244                |> put_req_header("accept", "application/activity+json")
 245                |> get("/objects/#{uuid}")
 246
 247       assert json_response(response, 200) == ObjectView.render("object.json", %{object: object})
 248     end
 249
 250     test "it returns a json representation of the object with accept application/json", %{
 251       conn: conn
 252     } do
 253       note = insert(:note)
 254       uuid = String.split(note.data["id"], "/") |> List.last()
 255
 256       conn =
 257         conn
 258         |> put_req_header("accept", "application/json")
 259         |> get("/objects/#{uuid}")
 260
 261       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
 262     end
 263
 264     test "it returns a json representation of the object with accept application/activity+json",
 265          %{conn: conn} do
 266       note = insert(:note)
 267       uuid = String.split(note.data["id"], "/") |> List.last()
 268
 269       conn =
 270         conn
 271         |> put_req_header("accept", "application/activity+json")
 272         |> get("/objects/#{uuid}")
 273
 274       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
 275     end
 276
 277     test "it returns a json representation of the object with accept application/ld+json", %{
 278       conn: conn
 279     } do
 280       note = insert(:note)
 281       uuid = String.split(note.data["id"], "/") |> List.last()
 282
 283       conn =
 284         conn
 285         |> put_req_header(
 286           "accept",
 287           "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
 288         )
 289         |> get("/objects/#{uuid}")
 290
 291       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
 292     end
 293
 294     test "it returns 404 for non-public messages", %{conn: conn} do
 295       note = insert(:direct_note)
 296       uuid = String.split(note.data["id"], "/") |> List.last()
 297
 298       conn =
 299         conn
 300         |> put_req_header("accept", "application/activity+json")
 301         |> get("/objects/#{uuid}")
 302
 303       assert json_response(conn, 404)
 304     end
 305
 306     test "returns visible non-public messages when authenticated", %{conn: conn} do
 307       note = insert(:direct_note)
 308       uuid = String.split(note.data["id"], "/") |> List.last()
 309       user = User.get_by_ap_id(note.data["actor"])
 310       marisa = insert(:user)
 311
 312       assert conn
 313              |> assign(:user, marisa)
 314              |> put_req_header("accept", "application/activity+json")
 315              |> get("/objects/#{uuid}")
 316              |> json_response(404)
 317
 318       assert response =
 319                conn
 320                |> assign(:user, user)
 321                |> put_req_header("accept", "application/activity+json")
 322                |> get("/objects/#{uuid}")
 323                |> json_response(200)
 324
 325       assert response == ObjectView.render("object.json", %{object: note})
 326     end
 327
 328     test "it returns 404 for tombstone objects", %{conn: conn} do
 329       tombstone = insert(:tombstone)
 330       uuid = String.split(tombstone.data["id"], "/") |> List.last()
 331
 332       conn =
 333         conn
 334         |> put_req_header("accept", "application/activity+json")
 335         |> get("/objects/#{uuid}")
 336
 337       assert json_response(conn, 404)
 338     end
 339
 340     test "it caches a response", %{conn: conn} do
 341       note = insert(:note)
 342       uuid = String.split(note.data["id"], "/") |> List.last()
 343
 344       conn1 =
 345         conn
 346         |> put_req_header("accept", "application/activity+json")
 347         |> get("/objects/#{uuid}")
 348
 349       assert json_response(conn1, :ok)
 350       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 351
 352       conn2 =
 353         conn
 354         |> put_req_header("accept", "application/activity+json")
 355         |> get("/objects/#{uuid}")
 356
 357       assert json_response(conn1, :ok) == json_response(conn2, :ok)
 358       assert Enum.any?(conn2.resp_headers, &(&1 == {"x-cache", "HIT from Pleroma"}))
 359     end
 360
 361     test "cached purged after object deletion", %{conn: conn} do
 362       note = insert(:note)
 363       uuid = String.split(note.data["id"], "/") |> List.last()
 364
 365       conn1 =
 366         conn
 367         |> put_req_header("accept", "application/activity+json")
 368         |> get("/objects/#{uuid}")
 369
 370       assert json_response(conn1, :ok)
 371       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 372
 373       Object.delete(note)
 374
 375       conn2 =
 376         conn
 377         |> put_req_header("accept", "application/activity+json")
 378         |> get("/objects/#{uuid}")
 379
 380       assert "Not found" == json_response(conn2, :not_found)
 381     end
 382   end
 383
 384   describe "/activities/:uuid" do
 385     test "it doesn't return a local-only activity", %{conn: conn} do
 386       user = insert(:user)
 387       {:ok, post} = CommonAPI.post(user, %{status: "test", visibility: "local"})
 388
 389       assert Pleroma.Web.ActivityPub.Visibility.is_local_public?(post)
 390
 391       uuid = String.split(post.data["id"], "/") |> List.last()
 392
 393       conn =
 394         conn
 395         |> put_req_header("accept", "application/json")
 396         |> get("/activities/#{uuid}")
 397
 398       assert json_response(conn, 404)
 399     end
 400
 401     test "returns local-only activities when authenticated", %{conn: conn} do
 402       user = insert(:user)
 403       {:ok, post} = CommonAPI.post(user, %{status: "test", visibility: "local"})
 404
 405       assert Pleroma.Web.ActivityPub.Visibility.is_local_public?(post)
 406
 407       uuid = String.split(post.data["id"], "/") |> List.last()
 408
 409       assert response =
 410                conn
 411                |> assign(:user, user)
 412                |> put_req_header("accept", "application/activity+json")
 413                |> get("/activities/#{uuid}")
 414
 415       assert json_response(response, 200) == ObjectView.render("object.json", %{object: post})
 416     end
 417
 418     test "it returns a json representation of the activity", %{conn: conn} do
 419       activity = insert(:note_activity)
 420       uuid = String.split(activity.data["id"], "/") |> List.last()
 421
 422       conn =
 423         conn
 424         |> put_req_header("accept", "application/activity+json")
 425         |> get("/activities/#{uuid}")
 426
 427       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: activity})
 428     end
 429
 430     test "it returns 404 for non-public activities", %{conn: conn} do
 431       activity = insert(:direct_note_activity)
 432       uuid = String.split(activity.data["id"], "/") |> List.last()
 433
 434       conn =
 435         conn
 436         |> put_req_header("accept", "application/activity+json")
 437         |> get("/activities/#{uuid}")
 438
 439       assert json_response(conn, 404)
 440     end
 441
 442     test "returns visible non-public messages when authenticated", %{conn: conn} do
 443       note = insert(:direct_note_activity)
 444       uuid = String.split(note.data["id"], "/") |> List.last()
 445       user = User.get_by_ap_id(note.data["actor"])
 446       marisa = insert(:user)
 447
 448       assert conn
 449              |> assign(:user, marisa)
 450              |> put_req_header("accept", "application/activity+json")
 451              |> get("/activities/#{uuid}")
 452              |> json_response(404)
 453
 454       assert response =
 455                conn
 456                |> assign(:user, user)
 457                |> put_req_header("accept", "application/activity+json")
 458                |> get("/activities/#{uuid}")
 459                |> json_response(200)
 460
 461       assert response == ObjectView.render("object.json", %{object: note})
 462     end
 463
 464     test "it caches a response", %{conn: conn} do
 465       activity = insert(:note_activity)
 466       uuid = String.split(activity.data["id"], "/") |> List.last()
 467
 468       conn1 =
 469         conn
 470         |> put_req_header("accept", "application/activity+json")
 471         |> get("/activities/#{uuid}")
 472
 473       assert json_response(conn1, :ok)
 474       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 475
 476       conn2 =
 477         conn
 478         |> put_req_header("accept", "application/activity+json")
 479         |> get("/activities/#{uuid}")
 480
 481       assert json_response(conn1, :ok) == json_response(conn2, :ok)
 482       assert Enum.any?(conn2.resp_headers, &(&1 == {"x-cache", "HIT from Pleroma"}))
 483     end
 484
 485     test "cached purged after activity deletion", %{conn: conn} do
 486       user = insert(:user)
 487       {:ok, activity} = CommonAPI.post(user, %{status: "cofe"})
 488
 489       uuid = String.split(activity.data["id"], "/") |> List.last()
 490
 491       conn1 =
 492         conn
 493         |> put_req_header("accept", "application/activity+json")
 494         |> get("/activities/#{uuid}")
 495
 496       assert json_response(conn1, :ok)
 497       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 498
 499       Activity.delete_all_by_object_ap_id(activity.object.data["id"])
 500
 501       conn2 =
 502         conn
 503         |> put_req_header("accept", "application/activity+json")
 504         |> get("/activities/#{uuid}")
 505
 506       assert "Not found" == json_response(conn2, :not_found)
 507     end
 508   end
 509
 510   describe "/inbox" do
 511     test "it inserts an incoming activity into the database", %{conn: conn} do
 512       data = File.read!("test/fixtures/mastodon-post-activity.json") |> Jason.decode!()
 513
 514       conn =
 515         conn
 516         |> assign(:valid_signature, true)
 517         |> put_req_header("content-type", "application/activity+json")
 518         |> post("/inbox", data)
 519
 520       assert "ok" == json_response(conn, 200)
 521
 522       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 523       assert Activity.get_by_ap_id(data["id"])
 524     end
 525
 526     @tag capture_log: true
 527     test "it inserts an incoming activity into the database" <>
 528            "even if we can't fetch the user but have it in our db",
 529          %{conn: conn} do
 530       user =
 531         insert(:user,
 532           ap_id: "https://mastodon.example.org/users/raymoo",
 533           ap_enabled: true,
 534           local: false,
 535           last_refreshed_at: nil
 536         )
 537
 538       data =
 539         File.read!("test/fixtures/mastodon-post-activity.json")
 540         |> Jason.decode!()
 541         |> Map.put("actor", user.ap_id)
 542         |> put_in(["object", "attributedTo"], user.ap_id)
 543
 544       conn =
 545         conn
 546         |> assign(:valid_signature, true)
 547         |> put_req_header("content-type", "application/activity+json")
 548         |> post("/inbox", data)
 549
 550       assert "ok" == json_response(conn, 200)
 551
 552       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 553       assert Activity.get_by_ap_id(data["id"])
 554     end
 555
 556     test "it clears `unreachable` federation status of the sender", %{conn: conn} do
 557       data = File.read!("test/fixtures/mastodon-post-activity.json") |> Jason.decode!()
 558
 559       sender_url = data["actor"]
 560       Instances.set_consistently_unreachable(sender_url)
 561       refute Instances.reachable?(sender_url)
 562
 563       conn =
 564         conn
 565         |> assign(:valid_signature, true)
 566         |> put_req_header("content-type", "application/activity+json")
 567         |> post("/inbox", data)
 568
 569       assert "ok" == json_response(conn, 200)
 570       assert Instances.reachable?(sender_url)
 571     end
 572
 573     test "accept follow activity", %{conn: conn} do
 574       clear_config([:instance, :federating], true)
 575       relay = Relay.get_actor()
 576
 577       assert {:ok, %Activity{} = activity} = Relay.follow("https://relay.mastodon.host/actor")
 578
 579       followed_relay = Pleroma.User.get_by_ap_id("https://relay.mastodon.host/actor")
 580       relay = refresh_record(relay)
 581
 582       accept =
 583         File.read!("test/fixtures/relay/accept-follow.json")
 584         |> String.replace("{{ap_id}}", relay.ap_id)
 585         |> String.replace("{{activity_id}}", activity.data["id"])
 586
 587       assert "ok" ==
 588                conn
 589                |> assign(:valid_signature, true)
 590                |> put_req_header("content-type", "application/activity+json")
 591                |> post("/inbox", accept)
 592                |> json_response(200)
 593
 594       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 595
 596       assert Pleroma.FollowingRelationship.following?(
 597                relay,
 598                followed_relay
 599              )
 600
 601       Mix.shell(Mix.Shell.Process)
 602
 603       on_exit(fn ->
 604         Mix.shell(Mix.Shell.IO)
 605       end)
 606
 607       :ok = Mix.Tasks.Pleroma.Relay.run(["list"])
 608       assert_receive {:mix_shell, :info, ["https://relay.mastodon.host/actor"]}
 609     end
 610
 611     @tag capture_log: true
 612     test "without valid signature, " <>
 613            "it only accepts Create activities and requires enabled federation",
 614          %{conn: conn} do
 615       data = File.read!("test/fixtures/mastodon-post-activity.json") |> Jason.decode!()
 616       non_create_data = File.read!("test/fixtures/mastodon-announce.json") |> Jason.decode!()
 617
 618       conn = put_req_header(conn, "content-type", "application/activity+json")
 619
 620       clear_config([:instance, :federating], false)
 621
 622       conn
 623       |> post("/inbox", data)
 624       |> json_response(403)
 625
 626       conn
 627       |> post("/inbox", non_create_data)
 628       |> json_response(403)
 629
 630       clear_config([:instance, :federating], true)
 631
 632       ret_conn = post(conn, "/inbox", data)
 633       assert "ok" == json_response(ret_conn, 200)
 634
 635       conn
 636       |> post("/inbox", non_create_data)
 637       |> json_response(400)
 638     end
 639
 640     test "accepts Add/Remove activities", %{conn: conn} do
 641       object_id = "c61d6733-e256-4fe1-ab13-1e369789423f"
 642
 643       status =
 644         File.read!("test/fixtures/statuses/note.json")
 645         |> String.replace("{{nickname}}", "lain")
 646         |> String.replace("{{object_id}}", object_id)
 647
 648       object_url = "https://example.com/objects/#{object_id}"
 649
 650       user =
 651         File.read!("test/fixtures/users_mock/user.json")
 652         |> String.replace("{{nickname}}", "lain")
 653
 654       actor = "https://example.com/users/lain"
 655
 656       Tesla.Mock.mock(fn
 657         %{
 658           method: :get,
 659           url: ^object_url
 660         } ->
 661           %Tesla.Env{
 662             status: 200,
 663             body: status,
 664             headers: [{"content-type", "application/activity+json"}]
 665           }
 666
 667         %{
 668           method: :get,
 669           url: ^actor
 670         } ->
 671           %Tesla.Env{
 672             status: 200,
 673             body: user,
 674             headers: [{"content-type", "application/activity+json"}]
 675           }
 676
 677         %{method: :get, url: "https://example.com/users/lain/collections/featured"} ->
 678           %Tesla.Env{
 679             status: 200,
 680             body:
 681               "test/fixtures/users_mock/masto_featured.json"
 682               |> File.read!()
 683               |> String.replace("{{domain}}", "example.com")
 684               |> String.replace("{{nickname}}", "lain"),
 685             headers: [{"content-type", "application/activity+json"}]
 686           }
 687       end)
 688
 689       data = %{
 690         "id" => "https://example.com/objects/d61d6733-e256-4fe1-ab13-1e369789423f",
 691         "actor" => actor,
 692         "object" => object_url,
 693         "target" => "https://example.com/users/lain/collections/featured",
 694         "type" => "Add",
 695         "to" => [Pleroma.Constants.as_public()]
 696       }
 697
 698       assert "ok" ==
 699                conn
 700                |> assign(:valid_signature, true)
 701                |> put_req_header("content-type", "application/activity+json")
 702                |> post("/inbox", data)
 703                |> json_response(200)
 704
 705       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 706       assert Activity.get_by_ap_id(data["id"])
 707       user = User.get_cached_by_ap_id(data["actor"])
 708       assert user.pinned_objects[data["object"]]
 709
 710       data = %{
 711         "id" => "https://example.com/objects/d61d6733-e256-4fe1-ab13-1e369789423d",
 712         "actor" => actor,
 713         "object" => object_url,
 714         "target" => "https://example.com/users/lain/collections/featured",
 715         "type" => "Remove",
 716         "to" => [Pleroma.Constants.as_public()]
 717       }
 718
 719       assert "ok" ==
 720                conn
 721                |> assign(:valid_signature, true)
 722                |> put_req_header("content-type", "application/activity+json")
 723                |> post("/inbox", data)
 724                |> json_response(200)
 725
 726       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 727       user = refresh_record(user)
 728       refute user.pinned_objects[data["object"]]
 729     end
 730
 731     test "mastodon pin/unpin", %{conn: conn} do
 732       status_id = "105786274556060421"
 733
 734       status =
 735         File.read!("test/fixtures/statuses/masto-note.json")
 736         |> String.replace("{{nickname}}", "lain")
 737         |> String.replace("{{status_id}}", status_id)
 738
 739       status_url = "https://example.com/users/lain/statuses/#{status_id}"
 740
 741       user =
 742         File.read!("test/fixtures/users_mock/user.json")
 743         |> String.replace("{{nickname}}", "lain")
 744
 745       actor = "https://example.com/users/lain"
 746
 747       Tesla.Mock.mock(fn
 748         %{
 749           method: :get,
 750           url: ^status_url
 751         } ->
 752           %Tesla.Env{
 753             status: 200,
 754             body: status,
 755             headers: [{"content-type", "application/activity+json"}]
 756           }
 757
 758         %{
 759           method: :get,
 760           url: ^actor
 761         } ->
 762           %Tesla.Env{
 763             status: 200,
 764             body: user,
 765             headers: [{"content-type", "application/activity+json"}]
 766           }
 767
 768         %{method: :get, url: "https://example.com/users/lain/collections/featured"} ->
 769           %Tesla.Env{
 770             status: 200,
 771             body:
 772               "test/fixtures/users_mock/masto_featured.json"
 773               |> File.read!()
 774               |> String.replace("{{domain}}", "example.com")
 775               |> String.replace("{{nickname}}", "lain"),
 776             headers: [{"content-type", "application/activity+json"}]
 777           }
 778       end)
 779
 780       data = %{
 781         "@context" => "https://www.w3.org/ns/activitystreams",
 782         "actor" => actor,
 783         "object" => status_url,
 784         "target" => "https://example.com/users/lain/collections/featured",
 785         "type" => "Add"
 786       }
 787
 788       assert "ok" ==
 789                conn
 790                |> assign(:valid_signature, true)
 791                |> put_req_header("content-type", "application/activity+json")
 792                |> post("/inbox", data)
 793                |> json_response(200)
 794
 795       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 796       assert Activity.get_by_object_ap_id_with_object(data["object"])
 797       user = User.get_cached_by_ap_id(data["actor"])
 798       assert user.pinned_objects[data["object"]]
 799
 800       data = %{
 801         "actor" => actor,
 802         "object" => status_url,
 803         "target" => "https://example.com/users/lain/collections/featured",
 804         "type" => "Remove"
 805       }
 806
 807       assert "ok" ==
 808                conn
 809                |> assign(:valid_signature, true)
 810                |> put_req_header("content-type", "application/activity+json")
 811                |> post("/inbox", data)
 812                |> json_response(200)
 813
 814       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 815       assert Activity.get_by_object_ap_id_with_object(data["object"])
 816       user = refresh_record(user)
 817       refute user.pinned_objects[data["object"]]
 818     end
 819   end
 820
 821   describe "/users/:nickname/inbox" do
 822     setup do
 823       data =
 824         File.read!("test/fixtures/mastodon-post-activity.json")
 825         |> Jason.decode!()
 826
 827       [data: data]
 828     end
 829
 830     test "it inserts an incoming activity into the database", %{conn: conn, data: data} do
 831       user = insert(:user)
 832
 833       data =
 834         data
 835         |> Map.put("bcc", [user.ap_id])
 836         |> Kernel.put_in(["object", "bcc"], [user.ap_id])
 837
 838       conn =
 839         conn
 840         |> assign(:valid_signature, true)
 841         |> put_req_header("content-type", "application/activity+json")
 842         |> post("/users/#{user.nickname}/inbox", data)
 843
 844       assert "ok" == json_response(conn, 200)
 845       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 846       assert Activity.get_by_ap_id(data["id"])
 847     end
 848
 849     test "it accepts messages with to as string instead of array", %{conn: conn, data: data} do
 850       user = insert(:user)
 851
 852       data =
 853         data
 854         |> Map.put("to", user.ap_id)
 855         |> Map.put("cc", [])
 856         |> Kernel.put_in(["object", "to"], user.ap_id)
 857         |> Kernel.put_in(["object", "cc"], [])
 858
 859       conn =
 860         conn
 861         |> assign(:valid_signature, true)
 862         |> put_req_header("content-type", "application/activity+json")
 863         |> post("/users/#{user.nickname}/inbox", data)
 864
 865       assert "ok" == json_response(conn, 200)
 866       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 867       assert Activity.get_by_ap_id(data["id"])
 868     end
 869
 870     test "it accepts messages with cc as string instead of array", %{conn: conn, data: data} do
 871       user = insert(:user)
 872
 873       data =
 874         data
 875         |> Map.put("to", [])
 876         |> Map.put("cc", user.ap_id)
 877         |> Kernel.put_in(["object", "to"], [])
 878         |> Kernel.put_in(["object", "cc"], user.ap_id)
 879
 880       conn =
 881         conn
 882         |> assign(:valid_signature, true)
 883         |> put_req_header("content-type", "application/activity+json")
 884         |> post("/users/#{user.nickname}/inbox", data)
 885
 886       assert "ok" == json_response(conn, 200)
 887       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 888       %Activity{} = activity = Activity.get_by_ap_id(data["id"])
 889       assert user.ap_id in activity.recipients
 890     end
 891
 892     test "it accepts messages with bcc as string instead of array", %{conn: conn, data: data} do
 893       user = insert(:user)
 894
 895       data =
 896         data
 897         |> Map.put("to", [])
 898         |> Map.put("cc", [])
 899         |> Map.put("bcc", user.ap_id)
 900         |> Kernel.put_in(["object", "to"], [])
 901         |> Kernel.put_in(["object", "cc"], [])
 902         |> Kernel.put_in(["object", "bcc"], user.ap_id)
 903
 904       conn =
 905         conn
 906         |> assign(:valid_signature, true)
 907         |> put_req_header("content-type", "application/activity+json")
 908         |> post("/users/#{user.nickname}/inbox", data)
 909
 910       assert "ok" == json_response(conn, 200)
 911       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 912       assert Activity.get_by_ap_id(data["id"])
 913     end
 914
 915     test "it accepts announces with to as string instead of array", %{conn: conn} do
 916       user = insert(:user)
 917
 918       {:ok, post} = CommonAPI.post(user, %{status: "hey"})
 919       announcer = insert(:user, local: false)
 920
 921       data = %{
 922         "@context" => "https://www.w3.org/ns/activitystreams",
 923         "actor" => announcer.ap_id,
 924         "id" => "#{announcer.ap_id}/statuses/19512778738411822/activity",
 925         "object" => post.data["object"],
 926         "to" => "https://www.w3.org/ns/activitystreams#Public",
 927         "cc" => [user.ap_id],
 928         "type" => "Announce"
 929       }
 930
 931       conn =
 932         conn
 933         |> assign(:valid_signature, true)
 934         |> put_req_header("content-type", "application/activity+json")
 935         |> post("/users/#{user.nickname}/inbox", data)
 936
 937       assert "ok" == json_response(conn, 200)
 938       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 939       %Activity{} = activity = Activity.get_by_ap_id(data["id"])
 940       assert "https://www.w3.org/ns/activitystreams#Public" in activity.recipients
 941     end
 942
 943     test "it accepts messages from actors that are followed by the user", %{
 944       conn: conn,
 945       data: data
 946     } do
 947       recipient = insert(:user)
 948       actor = insert(:user, %{ap_id: "http://mastodon.example.org/users/actor"})
 949
 950       {:ok, recipient, actor} = User.follow(recipient, actor)
 951
 952       object =
 953         data["object"]
 954         |> Map.put("attributedTo", actor.ap_id)
 955
 956       data =
 957         data
 958         |> Map.put("actor", actor.ap_id)
 959         |> Map.put("object", object)
 960
 961       conn =
 962         conn
 963         |> assign(:valid_signature, true)
 964         |> put_req_header("content-type", "application/activity+json")
 965         |> post("/users/#{recipient.nickname}/inbox", data)
 966
 967       assert "ok" == json_response(conn, 200)
 968       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 969       assert Activity.get_by_ap_id(data["id"])
 970     end
 971
 972     test "it rejects reads from other users", %{conn: conn} do
 973       user = insert(:user)
 974       other_user = insert(:user)
 975
 976       conn =
 977         conn
 978         |> assign(:user, other_user)
 979         |> put_req_header("accept", "application/activity+json")
 980         |> get("/users/#{user.nickname}/inbox")
 981
 982       assert json_response(conn, 403)
 983     end
 984
 985     test "it returns a note activity in a collection", %{conn: conn} do
 986       note_activity = insert(:direct_note_activity)
 987       note_object = Object.normalize(note_activity, fetch: false)
 988       user = User.get_cached_by_ap_id(hd(note_activity.data["to"]))
 989
 990       conn =
 991         conn
 992         |> assign(:user, user)
 993         |> put_req_header("accept", "application/activity+json")
 994         |> get("/users/#{user.nickname}/inbox?page=true")
 995
 996       assert response(conn, 200) =~ note_object.data["content"]
 997     end
 998
 999     test "it clears `unreachable` federation status of the sender", %{conn: conn, data: data} do
1000       user = insert(:user)
1001       data = Map.put(data, "bcc", [user.ap_id])
1002
1003       sender_host = URI.parse(data["actor"]).host
1004       Instances.set_consistently_unreachable(sender_host)
1005       refute Instances.reachable?(sender_host)
1006
1007       conn =
1008         conn
1009         |> assign(:valid_signature, true)
1010         |> put_req_header("content-type", "application/activity+json")
1011         |> post("/users/#{user.nickname}/inbox", data)
1012
1013       assert "ok" == json_response(conn, 200)
1014       assert Instances.reachable?(sender_host)
1015     end
1016
1017     @tag capture_log: true
1018     test "it removes all follower collections but actor's", %{conn: conn} do
1019       [actor, recipient] = insert_pair(:user)
1020
1021       to = [
1022         recipient.ap_id,
1023         recipient.follower_address,
1024         "https://www.w3.org/ns/activitystreams#Public"
1025       ]
1026
1027       cc = [recipient.follower_address, actor.follower_address]
1028
1029       data = %{
1030         "@context" => ["https://www.w3.org/ns/activitystreams"],
1031         "type" => "Create",
1032         "id" => Utils.generate_activity_id(),
1033         "to" => to,
1034         "cc" => cc,
1035         "actor" => actor.ap_id,
1036         "object" => %{
1037           "type" => "Note",
1038           "to" => to,
1039           "cc" => cc,
1040           "content" => "It's a note",
1041           "attributedTo" => actor.ap_id,
1042           "id" => Utils.generate_object_id()
1043         }
1044       }
1045
1046       conn
1047       |> assign(:valid_signature, true)
1048       |> put_req_header("content-type", "application/activity+json")
1049       |> post("/users/#{recipient.nickname}/inbox", data)
1050       |> json_response(200)
1051
1052       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
1053
1054       assert activity = Activity.get_by_ap_id(data["id"])
1055
1056       assert activity.id
1057       assert actor.follower_address in activity.recipients
1058       assert actor.follower_address in activity.data["cc"]
1059
1060       refute recipient.follower_address in activity.recipients
1061       refute recipient.follower_address in activity.data["cc"]
1062       refute recipient.follower_address in activity.data["to"]
1063     end
1064
1065     test "it requires authentication", %{conn: conn} do
1066       user = insert(:user)
1067       conn = put_req_header(conn, "accept", "application/activity+json")
1068
1069       ret_conn = get(conn, "/users/#{user.nickname}/inbox")
1070       assert json_response(ret_conn, 403)
1071
1072       ret_conn =
1073         conn
1074         |> assign(:user, user)
1075         |> get("/users/#{user.nickname}/inbox")
1076
1077       assert json_response(ret_conn, 200)
1078     end
1079
1080     @tag capture_log: true
1081     test "forwarded report", %{conn: conn} do
1082       admin = insert(:user, is_admin: true)
1083       actor = insert(:user, local: false)
1084       remote_domain = URI.parse(actor.ap_id).host
1085       reported_user = insert(:user)
1086
1087       note = insert(:note_activity, user: reported_user)
1088
1089       data = %{
1090         "@context" => [
1091           "https://www.w3.org/ns/activitystreams",
1092           "https://#{remote_domain}/schemas/litepub-0.1.jsonld",
1093           %{
1094             "@language" => "und"
1095           }
1096         ],
1097         "actor" => actor.ap_id,
1098         "cc" => [
1099           reported_user.ap_id
1100         ],
1101         "content" => "test",
1102         "context" => "context",
1103         "id" => "http://#{remote_domain}/activities/02be56cf-35e3-46b4-b2c6-47ae08dfee9e",
1104         "nickname" => reported_user.nickname,
1105         "object" => [
1106           reported_user.ap_id,
1107           %{
1108             "actor" => %{
1109               "actor_type" => "Person",
1110               "approval_pending" => false,
1111               "avatar" => "",
1112               "confirmation_pending" => false,
1113               "deactivated" => false,
1114               "display_name" => "test user",
1115               "id" => reported_user.id,
1116               "local" => false,
1117               "nickname" => reported_user.nickname,
1118               "registration_reason" => nil,
1119               "roles" => %{
1120                 "admin" => false,
1121                 "moderator" => false
1122               },
1123               "tags" => [],
1124               "url" => reported_user.ap_id
1125             },
1126             "content" => "",
1127             "id" => note.data["id"],
1128             "published" => note.data["published"],
1129             "type" => "Note"
1130           }
1131         ],
1132         "published" => note.data["published"],
1133         "state" => "open",
1134         "to" => [],
1135         "type" => "Flag"
1136       }
1137
1138       conn
1139       |> assign(:valid_signature, true)
1140       |> put_req_header("content-type", "application/activity+json")
1141       |> post("/users/#{reported_user.nickname}/inbox", data)
1142       |> json_response(200)
1143
1144       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
1145
1146       assert Pleroma.Repo.aggregate(Activity, :count, :id) == 2
1147
1148       ObanHelpers.perform_all()
1149
1150       Swoosh.TestAssertions.assert_email_sent(
1151         to: {admin.name, admin.email},
1152         html_body: ~r/Reported Account:/i
1153       )
1154     end
1155
1156     @tag capture_log: true
1157     test "forwarded report from mastodon", %{conn: conn} do
1158       admin = insert(:user, is_admin: true)
1159       actor = insert(:user, local: false)
1160       remote_domain = URI.parse(actor.ap_id).host
1161       remote_actor = "https://#{remote_domain}/actor"
1162       [reported_user, another] = insert_list(2, :user)
1163
1164       note = insert(:note_activity, user: reported_user)
1165
1166       Pleroma.Web.CommonAPI.favorite(another, note.id)
1167
1168       mock_json_body =
1169         "test/fixtures/mastodon/application_actor.json"
1170         |> File.read!()
1171         |> String.replace("{{DOMAIN}}", remote_domain)
1172
1173       Tesla.Mock.mock(fn %{url: ^remote_actor} ->
1174         %Tesla.Env{
1175           status: 200,
1176           body: mock_json_body,
1177           headers: [{"content-type", "application/activity+json"}]
1178         }
1179       end)
1180
1181       data = %{
1182         "@context" => "https://www.w3.org/ns/activitystreams",
1183         "actor" => remote_actor,
1184         "content" => "test report",
1185         "id" => "https://#{remote_domain}/e3b12fd1-948c-446e-b93b-a5e67edbe1d8",
1186         "object" => [
1187           reported_user.ap_id,
1188           note.data["object"]
1189         ],
1190         "type" => "Flag"
1191       }
1192
1193       conn
1194       |> assign(:valid_signature, true)
1195       |> put_req_header("content-type", "application/activity+json")
1196       |> post("/users/#{reported_user.nickname}/inbox", data)
1197       |> json_response(200)
1198
1199       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
1200
1201       flag_activity = "Flag" |> Pleroma.Activity.Queries.by_type() |> Pleroma.Repo.one()
1202       reported_user_ap_id = reported_user.ap_id
1203
1204       [^reported_user_ap_id, flag_data] = flag_activity.data["object"]
1205
1206       Enum.each(~w(actor content id published type), &Map.has_key?(flag_data, &1))
1207       ObanHelpers.perform_all()
1208
1209       Swoosh.TestAssertions.assert_email_sent(
1210         to: {admin.name, admin.email},
1211         html_body: ~r/#{note.data["object"]}/i
1212       )
1213     end
1214   end
1215
1216   describe "GET /users/:nickname/outbox" do
1217     test "it paginates correctly", %{conn: conn} do
1218       user = insert(:user)
1219       conn = assign(conn, :user, user)
1220       outbox_endpoint = user.ap_id <> "/outbox"
1221
1222       _posts =
1223         for i <- 0..25 do
1224           {:ok, activity} = CommonAPI.post(user, %{status: "post #{i}"})
1225           activity
1226         end
1227
1228       result =
1229         conn
1230         |> put_req_header("accept", "application/activity+json")
1231         |> get(outbox_endpoint <> "?page=true")
1232         |> json_response(200)
1233
1234       result_ids = Enum.map(result["orderedItems"], fn x -> x["id"] end)
1235       assert length(result["orderedItems"]) == 20
1236       assert length(result_ids) == 20
1237       assert result["next"]
1238       assert String.starts_with?(result["next"], outbox_endpoint)
1239
1240       result_next =
1241         conn
1242         |> put_req_header("accept", "application/activity+json")
1243         |> get(result["next"])
1244         |> json_response(200)
1245
1246       result_next_ids = Enum.map(result_next["orderedItems"], fn x -> x["id"] end)
1247       assert length(result_next["orderedItems"]) == 6
1248       assert length(result_next_ids) == 6
1249       refute Enum.find(result_next_ids, fn x -> x in result_ids end)
1250       refute Enum.find(result_ids, fn x -> x in result_next_ids end)
1251       assert String.starts_with?(result["id"], outbox_endpoint)
1252
1253       result_next_again =
1254         conn
1255         |> put_req_header("accept", "application/activity+json")
1256         |> get(result_next["id"])
1257         |> json_response(200)
1258
1259       assert result_next == result_next_again
1260     end
1261
1262     test "it returns 200 even if there're no activities", %{conn: conn} do
1263       user = insert(:user)
1264       outbox_endpoint = user.ap_id <> "/outbox"
1265
1266       conn =
1267         conn
1268         |> assign(:user, user)
1269         |> put_req_header("accept", "application/activity+json")
1270         |> get(outbox_endpoint)
1271
1272       result = json_response(conn, 200)
1273       assert outbox_endpoint == result["id"]
1274     end
1275
1276     test "it returns a note activity in a collection", %{conn: conn} do
1277       note_activity = insert(:note_activity)
1278       note_object = Object.normalize(note_activity, fetch: false)
1279       user = User.get_cached_by_ap_id(note_activity.data["actor"])
1280
1281       conn =
1282         conn
1283         |> assign(:user, user)
1284         |> put_req_header("accept", "application/activity+json")
1285         |> get("/users/#{user.nickname}/outbox?page=true")
1286
1287       assert response(conn, 200) =~ note_object.data["content"]
1288     end
1289
1290     test "it returns an announce activity in a collection", %{conn: conn} do
1291       announce_activity = insert(:announce_activity)
1292       user = User.get_cached_by_ap_id(announce_activity.data["actor"])
1293
1294       conn =
1295         conn
1296         |> assign(:user, user)
1297         |> put_req_header("accept", "application/activity+json")
1298         |> get("/users/#{user.nickname}/outbox?page=true")
1299
1300       assert response(conn, 200) =~ announce_activity.data["object"]
1301     end
1302
1303     test "It returns poll Answers when authenticated", %{conn: conn} do
1304       poller = insert(:user)
1305       voter = insert(:user)
1306
1307       {:ok, activity} =
1308         CommonAPI.post(poller, %{
1309           status: "suya...",
1310           poll: %{options: ["suya", "suya.", "suya.."], expires_in: 10}
1311         })
1312
1313       assert question = Object.normalize(activity, fetch: false)
1314
1315       {:ok, [activity], _object} = CommonAPI.vote(voter, question, [1])
1316
1317       assert outbox_get =
1318                conn
1319                |> assign(:user, voter)
1320                |> put_req_header("accept", "application/activity+json")
1321                |> get(voter.ap_id <> "/outbox?page=true")
1322                |> json_response(200)
1323
1324       assert [answer_outbox] = outbox_get["orderedItems"]
1325       assert answer_outbox["id"] == activity.data["id"]
1326     end
1327   end
1328
1329   describe "POST /users/:nickname/outbox (C2S)" do
1330     setup do: clear_config([:instance, :limit])
1331
1332     setup do
1333       [
1334         activity: %{
1335           "@context" => "https://www.w3.org/ns/activitystreams",
1336           "type" => "Create",
1337           "object" => %{"type" => "Note", "content" => "AP C2S test"},
1338           "to" => "https://www.w3.org/ns/activitystreams#Public",
1339           "cc" => []
1340         }
1341       ]
1342     end
1343
1344     test "it rejects posts from other users / unauthenticated users", %{
1345       conn: conn,
1346       activity: activity
1347     } do
1348       user = insert(:user)
1349       other_user = insert(:user)
1350       conn = put_req_header(conn, "content-type", "application/activity+json")
1351
1352       conn
1353       |> post("/users/#{user.nickname}/outbox", activity)
1354       |> json_response(403)
1355
1356       conn
1357       |> assign(:user, other_user)
1358       |> post("/users/#{user.nickname}/outbox", activity)
1359       |> json_response(403)
1360     end
1361
1362     test "it inserts an incoming create activity into the database", %{
1363       conn: conn,
1364       activity: activity
1365     } do
1366       user = insert(:user)
1367
1368       result =
1369         conn
1370         |> assign(:user, user)
1371         |> put_req_header("content-type", "application/activity+json")
1372         |> post("/users/#{user.nickname}/outbox", activity)
1373         |> json_response(201)
1374
1375       assert Activity.get_by_ap_id(result["id"])
1376       assert result["object"]
1377       assert %Object{data: object} = Object.normalize(result["object"], fetch: false)
1378       assert object["content"] == activity["object"]["content"]
1379     end
1380
1381     test "it rejects anything beyond 'Note' creations", %{conn: conn, activity: activity} do
1382       user = insert(:user)
1383
1384       activity =
1385         activity
1386         |> put_in(["object", "type"], "Benis")
1387
1388       _result =
1389         conn
1390         |> assign(:user, user)
1391         |> put_req_header("content-type", "application/activity+json")
1392         |> post("/users/#{user.nickname}/outbox", activity)
1393         |> json_response(400)
1394     end
1395
1396     test "it inserts an incoming sensitive activity into the database", %{
1397       conn: conn,
1398       activity: activity
1399     } do
1400       user = insert(:user)
1401       conn = assign(conn, :user, user)
1402       object = Map.put(activity["object"], "sensitive", true)
1403       activity = Map.put(activity, "object", object)
1404
1405       response =
1406         conn
1407         |> put_req_header("content-type", "application/activity+json")
1408         |> post("/users/#{user.nickname}/outbox", activity)
1409         |> json_response(201)
1410
1411       assert Activity.get_by_ap_id(response["id"])
1412       assert response["object"]
1413       assert %Object{data: response_object} = Object.normalize(response["object"], fetch: false)
1414       assert response_object["sensitive"] == true
1415       assert response_object["content"] == activity["object"]["content"]
1416
1417       representation =
1418         conn
1419         |> put_req_header("accept", "application/activity+json")
1420         |> get(response["id"])
1421         |> json_response(200)
1422
1423       assert representation["object"]["sensitive"] == true
1424     end
1425
1426     test "it rejects an incoming activity with bogus type", %{conn: conn, activity: activity} do
1427       user = insert(:user)
1428       activity = Map.put(activity, "type", "BadType")
1429
1430       conn =
1431         conn
1432         |> assign(:user, user)
1433         |> put_req_header("content-type", "application/activity+json")
1434         |> post("/users/#{user.nickname}/outbox", activity)
1435
1436       assert json_response(conn, 400)
1437     end
1438
1439     test "it erects a tombstone when receiving a delete activity", %{conn: conn} do
1440       note_activity = insert(:note_activity)
1441       note_object = Object.normalize(note_activity, fetch: false)
1442       user = User.get_cached_by_ap_id(note_activity.data["actor"])
1443
1444       data = %{
1445         type: "Delete",
1446         object: %{
1447           id: note_object.data["id"]
1448         }
1449       }
1450
1451       conn =
1452         conn
1453         |> assign(:user, user)
1454         |> put_req_header("content-type", "application/activity+json")
1455         |> post("/users/#{user.nickname}/outbox", data)
1456
1457       result = json_response(conn, 201)
1458       assert Activity.get_by_ap_id(result["id"])
1459
1460       assert object = Object.get_by_ap_id(note_object.data["id"])
1461       assert object.data["type"] == "Tombstone"
1462     end
1463
1464     test "it rejects delete activity of object from other actor", %{conn: conn} do
1465       note_activity = insert(:note_activity)
1466       note_object = Object.normalize(note_activity, fetch: false)
1467       user = insert(:user)
1468
1469       data = %{
1470         type: "Delete",
1471         object: %{
1472           id: note_object.data["id"]
1473         }
1474       }
1475
1476       conn =
1477         conn
1478         |> assign(:user, user)
1479         |> put_req_header("content-type", "application/activity+json")
1480         |> post("/users/#{user.nickname}/outbox", data)
1481
1482       assert json_response(conn, 400)
1483     end
1484
1485     test "it increases like count when receiving a like action", %{conn: conn} do
1486       note_activity = insert(:note_activity)
1487       note_object = Object.normalize(note_activity, fetch: false)
1488       user = User.get_cached_by_ap_id(note_activity.data["actor"])
1489
1490       data = %{
1491         type: "Like",
1492         object: %{
1493           id: note_object.data["id"]
1494         }
1495       }
1496
1497       conn =
1498         conn
1499         |> assign(:user, user)
1500         |> put_req_header("content-type", "application/activity+json")
1501         |> post("/users/#{user.nickname}/outbox", data)
1502
1503       result = json_response(conn, 201)
1504       assert Activity.get_by_ap_id(result["id"])
1505
1506       assert object = Object.get_by_ap_id(note_object.data["id"])
1507       assert object.data["like_count"] == 1
1508     end
1509
1510     test "it doesn't spreads faulty attributedTo or actor fields", %{
1511       conn: conn,
1512       activity: activity
1513     } do
1514       reimu = insert(:user, nickname: "reimu")
1515       cirno = insert(:user, nickname: "cirno")
1516
1517       assert reimu.ap_id
1518       assert cirno.ap_id
1519
1520       activity =
1521         activity
1522         |> put_in(["object", "actor"], reimu.ap_id)
1523         |> put_in(["object", "attributedTo"], reimu.ap_id)
1524         |> put_in(["actor"], reimu.ap_id)
1525         |> put_in(["attributedTo"], reimu.ap_id)
1526
1527       _reimu_outbox =
1528         conn
1529         |> assign(:user, cirno)
1530         |> put_req_header("content-type", "application/activity+json")
1531         |> post("/users/#{reimu.nickname}/outbox", activity)
1532         |> json_response(403)
1533
1534       cirno_outbox =
1535         conn
1536         |> assign(:user, cirno)
1537         |> put_req_header("content-type", "application/activity+json")
1538         |> post("/users/#{cirno.nickname}/outbox", activity)
1539         |> json_response(201)
1540
1541       assert cirno_outbox["attributedTo"] == nil
1542       assert cirno_outbox["actor"] == cirno.ap_id
1543
1544       assert cirno_object = Object.normalize(cirno_outbox["object"], fetch: false)
1545       assert cirno_object.data["actor"] == cirno.ap_id
1546       assert cirno_object.data["attributedTo"] == cirno.ap_id
1547     end
1548
1549     test "Character limitation", %{conn: conn, activity: activity} do
1550       clear_config([:instance, :limit], 5)
1551       user = insert(:user)
1552
1553       result =
1554         conn
1555         |> assign(:user, user)
1556         |> put_req_header("content-type", "application/activity+json")
1557         |> post("/users/#{user.nickname}/outbox", activity)
1558         |> json_response(400)
1559
1560       assert result == "Note is over the character limit"
1561     end
1562   end
1563
1564   describe "/relay/followers" do
1565     test "it returns relay followers", %{conn: conn} do
1566       relay_actor = Relay.get_actor()
1567       user = insert(:user)
1568       User.follow(user, relay_actor)
1569
1570       result =
1571         conn
1572         |> get("/relay/followers")
1573         |> json_response(200)
1574
1575       assert result["first"]["orderedItems"] == [user.ap_id]
1576     end
1577
1578     test "on non-federating instance, it returns 404", %{conn: conn} do
1579       clear_config([:instance, :federating], false)
1580       user = insert(:user)
1581
1582       conn
1583       |> assign(:user, user)
1584       |> get("/relay/followers")
1585       |> json_response(404)
1586     end
1587   end
1588
1589   describe "/relay/following" do
1590     test "it returns relay following", %{conn: conn} do
1591       result =
1592         conn
1593         |> get("/relay/following")
1594         |> json_response(200)
1595
1596       assert result["first"]["orderedItems"] == []
1597     end
1598
1599     test "on non-federating instance, it returns 404", %{conn: conn} do
1600       clear_config([:instance, :federating], false)
1601       user = insert(:user)
1602
1603       conn
1604       |> assign(:user, user)
1605       |> get("/relay/following")
1606       |> json_response(404)
1607     end
1608   end
1609
1610   describe "/users/:nickname/followers" do
1611     test "it returns the followers in a collection", %{conn: conn} do
1612       user = insert(:user)
1613       user_two = insert(:user)
1614       User.follow(user, user_two)
1615
1616       result =
1617         conn
1618         |> assign(:user, user_two)
1619         |> get("/users/#{user_two.nickname}/followers")
1620         |> json_response(200)
1621
1622       assert result["first"]["orderedItems"] == [user.ap_id]
1623     end
1624
1625     test "it returns a uri if the user has 'hide_followers' set", %{conn: conn} do
1626       user = insert(:user)
1627       user_two = insert(:user, hide_followers: true)
1628       User.follow(user, user_two)
1629
1630       result =
1631         conn
1632         |> assign(:user, user)
1633         |> get("/users/#{user_two.nickname}/followers")
1634         |> json_response(200)
1635
1636       assert is_binary(result["first"])
1637     end
1638
1639     test "it returns a 403 error on pages, if the user has 'hide_followers' set and the request is from another user",
1640          %{conn: conn} do
1641       user = insert(:user)
1642       other_user = insert(:user, hide_followers: true)
1643
1644       result =
1645         conn
1646         |> assign(:user, user)
1647         |> get("/users/#{other_user.nickname}/followers?page=1")
1648
1649       assert result.status == 403
1650       assert result.resp_body == ""
1651     end
1652
1653     test "it renders the page, if the user has 'hide_followers' set and the request is authenticated with the same user",
1654          %{conn: conn} do
1655       user = insert(:user, hide_followers: true)
1656       other_user = insert(:user)
1657       {:ok, _other_user, user, _activity} = CommonAPI.follow(other_user, user)
1658
1659       result =
1660         conn
1661         |> assign(:user, user)
1662         |> get("/users/#{user.nickname}/followers?page=1")
1663         |> json_response(200)
1664
1665       assert result["totalItems"] == 1
1666       assert result["orderedItems"] == [other_user.ap_id]
1667     end
1668
1669     test "it works for more than 10 users", %{conn: conn} do
1670       user = insert(:user)
1671
1672       Enum.each(1..15, fn _ ->
1673         other_user = insert(:user)
1674         User.follow(other_user, user)
1675       end)
1676
1677       result =
1678         conn
1679         |> assign(:user, user)
1680         |> get("/users/#{user.nickname}/followers")
1681         |> json_response(200)
1682
1683       assert length(result["first"]["orderedItems"]) == 10
1684       assert result["first"]["totalItems"] == 15
1685       assert result["totalItems"] == 15
1686
1687       result =
1688         conn
1689         |> assign(:user, user)
1690         |> get("/users/#{user.nickname}/followers?page=2")
1691         |> json_response(200)
1692
1693       assert length(result["orderedItems"]) == 5
1694       assert result["totalItems"] == 15
1695     end
1696
1697     test "does not require authentication", %{conn: conn} do
1698       user = insert(:user)
1699
1700       conn
1701       |> get("/users/#{user.nickname}/followers")
1702       |> json_response(200)
1703     end
1704   end
1705
1706   describe "/users/:nickname/following" do
1707     test "it returns the following in a collection", %{conn: conn} do
1708       user = insert(:user)
1709       user_two = insert(:user)
1710       User.follow(user, user_two)
1711
1712       result =
1713         conn
1714         |> assign(:user, user)
1715         |> get("/users/#{user.nickname}/following")
1716         |> json_response(200)
1717
1718       assert result["first"]["orderedItems"] == [user_two.ap_id]
1719     end
1720
1721     test "it returns a uri if the user has 'hide_follows' set", %{conn: conn} do
1722       user = insert(:user)
1723       user_two = insert(:user, hide_follows: true)
1724       User.follow(user, user_two)
1725
1726       result =
1727         conn
1728         |> assign(:user, user)
1729         |> get("/users/#{user_two.nickname}/following")
1730         |> json_response(200)
1731
1732       assert is_binary(result["first"])
1733     end
1734
1735     test "it returns a 403 error on pages, if the user has 'hide_follows' set and the request is from another user",
1736          %{conn: conn} do
1737       user = insert(:user)
1738       user_two = insert(:user, hide_follows: true)
1739
1740       result =
1741         conn
1742         |> assign(:user, user)
1743         |> get("/users/#{user_two.nickname}/following?page=1")
1744
1745       assert result.status == 403
1746       assert result.resp_body == ""
1747     end
1748
1749     test "it renders the page, if the user has 'hide_follows' set and the request is authenticated with the same user",
1750          %{conn: conn} do
1751       user = insert(:user, hide_follows: true)
1752       other_user = insert(:user)
1753       {:ok, user, _other_user, _activity} = CommonAPI.follow(user, other_user)
1754
1755       result =
1756         conn
1757         |> assign(:user, user)
1758         |> get("/users/#{user.nickname}/following?page=1")
1759         |> json_response(200)
1760
1761       assert result["totalItems"] == 1
1762       assert result["orderedItems"] == [other_user.ap_id]
1763     end
1764
1765     test "it works for more than 10 users", %{conn: conn} do
1766       user = insert(:user)
1767
1768       Enum.each(1..15, fn _ ->
1769         user = User.get_cached_by_id(user.id)
1770         other_user = insert(:user)
1771         User.follow(user, other_user)
1772       end)
1773
1774       result =
1775         conn
1776         |> assign(:user, user)
1777         |> get("/users/#{user.nickname}/following")
1778         |> json_response(200)
1779
1780       assert length(result["first"]["orderedItems"]) == 10
1781       assert result["first"]["totalItems"] == 15
1782       assert result["totalItems"] == 15
1783
1784       result =
1785         conn
1786         |> assign(:user, user)
1787         |> get("/users/#{user.nickname}/following?page=2")
1788         |> json_response(200)
1789
1790       assert length(result["orderedItems"]) == 5
1791       assert result["totalItems"] == 15
1792     end
1793
1794     test "does not require authentication", %{conn: conn} do
1795       user = insert(:user)
1796
1797       conn
1798       |> get("/users/#{user.nickname}/following")
1799       |> json_response(200)
1800     end
1801   end
1802
1803   describe "delivery tracking" do
1804     test "it tracks a signed object fetch", %{conn: conn} do
1805       user = insert(:user, local: false)
1806       activity = insert(:note_activity)
1807       object = Object.normalize(activity, fetch: false)
1808
1809       object_path = String.trim_leading(object.data["id"], Pleroma.Web.Endpoint.url())
1810
1811       conn
1812       |> put_req_header("accept", "application/activity+json")
1813       |> assign(:user, user)
1814       |> get(object_path)
1815       |> json_response(200)
1816
1817       assert Delivery.get(object.id, user.id)
1818     end
1819
1820     test "it tracks a signed activity fetch", %{conn: conn} do
1821       user = insert(:user, local: false)
1822       activity = insert(:note_activity)
1823       object = Object.normalize(activity, fetch: false)
1824
1825       activity_path = String.trim_leading(activity.data["id"], Pleroma.Web.Endpoint.url())
1826
1827       conn
1828       |> put_req_header("accept", "application/activity+json")
1829       |> assign(:user, user)
1830       |> get(activity_path)
1831       |> json_response(200)
1832
1833       assert Delivery.get(object.id, user.id)
1834     end
1835
1836     test "it tracks a signed object fetch when the json is cached", %{conn: conn} do
1837       user = insert(:user, local: false)
1838       other_user = insert(:user, local: false)
1839       activity = insert(:note_activity)
1840       object = Object.normalize(activity, fetch: false)
1841
1842       object_path = String.trim_leading(object.data["id"], Pleroma.Web.Endpoint.url())
1843
1844       conn
1845       |> put_req_header("accept", "application/activity+json")
1846       |> assign(:user, user)
1847       |> get(object_path)
1848       |> json_response(200)
1849
1850       build_conn()
1851       |> put_req_header("accept", "application/activity+json")
1852       |> assign(:user, other_user)
1853       |> get(object_path)
1854       |> json_response(200)
1855
1856       assert Delivery.get(object.id, user.id)
1857       assert Delivery.get(object.id, other_user.id)
1858     end
1859
1860     test "it tracks a signed activity fetch when the json is cached", %{conn: conn} do
1861       user = insert(:user, local: false)
1862       other_user = insert(:user, local: false)
1863       activity = insert(:note_activity)
1864       object = Object.normalize(activity, fetch: false)
1865
1866       activity_path = String.trim_leading(activity.data["id"], Pleroma.Web.Endpoint.url())
1867
1868       conn
1869       |> put_req_header("accept", "application/activity+json")
1870       |> assign(:user, user)
1871       |> get(activity_path)
1872       |> json_response(200)
1873
1874       build_conn()
1875       |> put_req_header("accept", "application/activity+json")
1876       |> assign(:user, other_user)
1877       |> get(activity_path)
1878       |> json_response(200)
1879
1880       assert Delivery.get(object.id, user.id)
1881       assert Delivery.get(object.id, other_user.id)
1882     end
1883   end
1884
1885   describe "Additional ActivityPub C2S endpoints" do
1886     test "GET /api/ap/whoami", %{conn: conn} do
1887       user = insert(:user)
1888
1889       conn =
1890         conn
1891         |> assign(:user, user)
1892         |> get("/api/ap/whoami")
1893
1894       user = User.get_cached_by_id(user.id)
1895
1896       assert UserView.render("user.json", %{user: user}) == json_response(conn, 200)
1897
1898       conn
1899       |> get("/api/ap/whoami")
1900       |> json_response(403)
1901     end
1902
1903     setup do: clear_config([:media_proxy])
1904     setup do: clear_config([Pleroma.Upload])
1905
1906     test "POST /api/ap/upload_media", %{conn: conn} do
1907       user = insert(:user)
1908
1909       desc = "Description of the image"
1910
1911       image = %Plug.Upload{
1912         content_type: "image/jpeg",
1913         path: Path.absname("test/fixtures/image.jpg"),
1914         filename: "an_image.jpg"
1915       }
1916
1917       object =
1918         conn
1919         |> assign(:user, user)
1920         |> post("/api/ap/upload_media", %{"file" => image, "description" => desc})
1921         |> json_response(:created)
1922
1923       assert object["name"] == desc
1924       assert object["type"] == "Document"
1925       assert object["actor"] == user.ap_id
1926       assert [%{"href" => object_href, "mediaType" => object_mediatype}] = object["url"]
1927       assert is_binary(object_href)
1928       assert object_mediatype == "image/jpeg"
1929       assert String.ends_with?(object_href, ".jpg")
1930
1931       activity_request = %{
1932         "@context" => "https://www.w3.org/ns/activitystreams",
1933         "type" => "Create",
1934         "object" => %{
1935           "type" => "Note",
1936           "content" => "AP C2S test, attachment",
1937           "attachment" => [object]
1938         },
1939         "to" => "https://www.w3.org/ns/activitystreams#Public",
1940         "cc" => []
1941       }
1942
1943       activity_response =
1944         conn
1945         |> assign(:user, user)
1946         |> post("/users/#{user.nickname}/outbox", activity_request)
1947         |> json_response(:created)
1948
1949       assert activity_response["id"]
1950       assert activity_response["object"]
1951       assert activity_response["actor"] == user.ap_id
1952
1953       assert %Object{data: %{"attachment" => [attachment]}} =
1954                Object.normalize(activity_response["object"], fetch: false)
1955
1956       assert attachment["type"] == "Document"
1957       assert attachment["name"] == desc
1958
1959       assert [
1960                %{
1961                  "href" => ^object_href,
1962                  "type" => "Link",
1963                  "mediaType" => ^object_mediatype
1964                }
1965              ] = attachment["url"]
1966
1967       # Fails if unauthenticated
1968       conn
1969       |> post("/api/ap/upload_media", %{"file" => image, "description" => desc})
1970       |> json_response(403)
1971     end
1972   end
1973
1974   test "pinned collection", %{conn: conn} do
1975     clear_config([:instance, :max_pinned_statuses], 2)
1976     user = insert(:user)
1977     objects = insert_list(2, :note, user: user)
1978
1979     Enum.reduce(objects, user, fn %{data: %{"id" => object_id}}, user ->
1980       {:ok, updated} = User.add_pinned_object_id(user, object_id)
1981       updated
1982     end)
1983
1984     %{nickname: nickname, featured_address: featured_address, pinned_objects: pinned_objects} =
1985       refresh_record(user)
1986
1987     %{"id" => ^featured_address, "orderedItems" => items, "totalItems" => 2} =
1988       conn
1989       |> get("/users/#{nickname}/collections/featured")
1990       |> json_response(200)
1991
1992     object_ids = Enum.map(items, & &1["id"])
1993
1994     assert Enum.all?(pinned_objects, fn {obj_id, _} ->
1995              obj_id in object_ids
1996            end)
1997   end
1998 end