activity_pub_controller: Add authentication to object & activity endpoints
[akkoma] / test / pleroma / web / activity_pub / visibility_test.exs
1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
4
5 defmodule Pleroma.Web.ActivityPub.VisibilityTest do
6 use Pleroma.DataCase, async: true
7
8 alias Pleroma.Activity
9 alias Pleroma.Object
10 alias Pleroma.Web.ActivityPub.Visibility
11 alias Pleroma.Web.CommonAPI
12 import Pleroma.Factory
13
14 setup do
15 user = insert(:user)
16 mentioned = insert(:user)
17 following = insert(:user)
18 unrelated = insert(:user)
19 {:ok, following, user} = Pleroma.User.follow(following, user)
20 {:ok, list} = Pleroma.List.create("foo", user)
21
22 Pleroma.List.follow(list, unrelated)
23
24 {:ok, public} =
25 CommonAPI.post(user, %{status: "@#{mentioned.nickname}", visibility: "public"})
26
27 {:ok, private} =
28 CommonAPI.post(user, %{status: "@#{mentioned.nickname}", visibility: "private"})
29
30 {:ok, direct} =
31 CommonAPI.post(user, %{status: "@#{mentioned.nickname}", visibility: "direct"})
32
33 {:ok, unlisted} =
34 CommonAPI.post(user, %{status: "@#{mentioned.nickname}", visibility: "unlisted"})
35
36 {:ok, list} =
37 CommonAPI.post(user, %{
38 status: "@#{mentioned.nickname}",
39 visibility: "list:#{list.id}"
40 })
41
42 %{
43 public: public,
44 private: private,
45 direct: direct,
46 unlisted: unlisted,
47 user: user,
48 mentioned: mentioned,
49 following: following,
50 unrelated: unrelated,
51 list: list
52 }
53 end
54
55 test "is_direct?", %{
56 public: public,
57 private: private,
58 direct: direct,
59 unlisted: unlisted,
60 list: list
61 } do
62 assert Visibility.is_direct?(direct)
63 refute Visibility.is_direct?(public)
64 refute Visibility.is_direct?(private)
65 refute Visibility.is_direct?(unlisted)
66 assert Visibility.is_direct?(list)
67 end
68
69 test "is_public?", %{
70 public: public,
71 private: private,
72 direct: direct,
73 unlisted: unlisted,
74 list: list
75 } do
76 refute Visibility.is_public?(direct)
77 assert Visibility.is_public?(public)
78 refute Visibility.is_public?(private)
79 assert Visibility.is_public?(unlisted)
80 refute Visibility.is_public?(list)
81 end
82
83 test "is_private?", %{
84 public: public,
85 private: private,
86 direct: direct,
87 unlisted: unlisted,
88 list: list
89 } do
90 refute Visibility.is_private?(direct)
91 refute Visibility.is_private?(public)
92 assert Visibility.is_private?(private)
93 refute Visibility.is_private?(unlisted)
94 refute Visibility.is_private?(list)
95 end
96
97 test "is_list?", %{
98 public: public,
99 private: private,
100 direct: direct,
101 unlisted: unlisted,
102 list: list
103 } do
104 refute Visibility.is_list?(direct)
105 refute Visibility.is_list?(public)
106 refute Visibility.is_list?(private)
107 refute Visibility.is_list?(unlisted)
108 assert Visibility.is_list?(list)
109 end
110
111 test "visible_for_user? Activity", %{
112 public: public,
113 private: private,
114 direct: direct,
115 unlisted: unlisted,
116 user: user,
117 mentioned: mentioned,
118 following: following,
119 unrelated: unrelated,
120 list: list
121 } do
122 # All visible to author
123
124 assert Visibility.visible_for_user?(public, user)
125 assert Visibility.visible_for_user?(private, user)
126 assert Visibility.visible_for_user?(unlisted, user)
127 assert Visibility.visible_for_user?(direct, user)
128 assert Visibility.visible_for_user?(list, user)
129
130 # All visible to a mentioned user
131
132 assert Visibility.visible_for_user?(public, mentioned)
133 assert Visibility.visible_for_user?(private, mentioned)
134 assert Visibility.visible_for_user?(unlisted, mentioned)
135 assert Visibility.visible_for_user?(direct, mentioned)
136 assert Visibility.visible_for_user?(list, mentioned)
137
138 # DM not visible for just follower
139
140 assert Visibility.visible_for_user?(public, following)
141 assert Visibility.visible_for_user?(private, following)
142 assert Visibility.visible_for_user?(unlisted, following)
143 refute Visibility.visible_for_user?(direct, following)
144 refute Visibility.visible_for_user?(list, following)
145
146 # Public and unlisted visible for unrelated user
147
148 assert Visibility.visible_for_user?(public, unrelated)
149 assert Visibility.visible_for_user?(unlisted, unrelated)
150 refute Visibility.visible_for_user?(private, unrelated)
151 refute Visibility.visible_for_user?(direct, unrelated)
152
153 # Public and unlisted visible for unauthenticated
154
155 assert Visibility.visible_for_user?(public, nil)
156 assert Visibility.visible_for_user?(unlisted, nil)
157 refute Visibility.visible_for_user?(private, nil)
158 refute Visibility.visible_for_user?(direct, nil)
159
160 # Visible for a list member
161 assert Visibility.visible_for_user?(list, unrelated)
162 end
163
164 test "visible_for_user? Object", %{
165 public: public,
166 private: private,
167 direct: direct,
168 unlisted: unlisted,
169 user: user,
170 mentioned: mentioned,
171 following: following,
172 unrelated: unrelated,
173 list: list
174 } do
175 public = Object.normalize(public)
176 private = Object.normalize(private)
177 unlisted = Object.normalize(unlisted)
178 direct = Object.normalize(direct)
179 list = Object.normalize(list)
180
181 # All visible to author
182
183 assert Visibility.visible_for_user?(public, user)
184 assert Visibility.visible_for_user?(private, user)
185 assert Visibility.visible_for_user?(unlisted, user)
186 assert Visibility.visible_for_user?(direct, user)
187 assert Visibility.visible_for_user?(list, user)
188
189 # All visible to a mentioned user
190
191 assert Visibility.visible_for_user?(public, mentioned)
192 assert Visibility.visible_for_user?(private, mentioned)
193 assert Visibility.visible_for_user?(unlisted, mentioned)
194 assert Visibility.visible_for_user?(direct, mentioned)
195 assert Visibility.visible_for_user?(list, mentioned)
196
197 # DM not visible for just follower
198
199 assert Visibility.visible_for_user?(public, following)
200 assert Visibility.visible_for_user?(private, following)
201 assert Visibility.visible_for_user?(unlisted, following)
202 refute Visibility.visible_for_user?(direct, following)
203 refute Visibility.visible_for_user?(list, following)
204
205 # Public and unlisted visible for unrelated user
206
207 assert Visibility.visible_for_user?(public, unrelated)
208 assert Visibility.visible_for_user?(unlisted, unrelated)
209 refute Visibility.visible_for_user?(private, unrelated)
210 refute Visibility.visible_for_user?(direct, unrelated)
211
212 # Public and unlisted visible for unauthenticated
213
214 assert Visibility.visible_for_user?(public, nil)
215 assert Visibility.visible_for_user?(unlisted, nil)
216 refute Visibility.visible_for_user?(private, nil)
217 refute Visibility.visible_for_user?(direct, nil)
218
219 # Visible for a list member
220 # assert Visibility.visible_for_user?(list, unrelated)
221 end
222
223 test "doesn't die when the user doesn't exist",
224 %{
225 direct: direct,
226 user: user
227 } do
228 Repo.delete(user)
229 Pleroma.User.invalidate_cache(user)
230 refute Visibility.is_private?(direct)
231 end
232
233 test "get_visibility", %{
234 public: public,
235 private: private,
236 direct: direct,
237 unlisted: unlisted,
238 list: list
239 } do
240 assert Visibility.get_visibility(public) == "public"
241 assert Visibility.get_visibility(private) == "private"
242 assert Visibility.get_visibility(direct) == "direct"
243 assert Visibility.get_visibility(unlisted) == "unlisted"
244 assert Visibility.get_visibility(list) == "list"
245 end
246
247 test "get_visibility with directMessage flag" do
248 assert Visibility.get_visibility(%{data: %{"directMessage" => true}}) == "direct"
249 end
250
251 test "get_visibility with listMessage flag" do
252 assert Visibility.get_visibility(%{data: %{"listMessage" => ""}}) == "list"
253 end
254
255 describe "entire_thread_visible_for_user?/2" do
256 test "returns false if not found activity", %{user: user} do
257 refute Visibility.entire_thread_visible_for_user?(%Activity{}, user)
258 end
259
260 test "returns true if activity hasn't 'Create' type", %{user: user} do
261 activity = insert(:like_activity)
262 assert Visibility.entire_thread_visible_for_user?(activity, user)
263 end
264
265 test "returns false when invalid recipients", %{user: user} do
266 author = insert(:user)
267
268 activity =
269 insert(:note_activity,
270 note:
271 insert(:note,
272 user: author,
273 data: %{"to" => ["test-user"]}
274 )
275 )
276
277 refute Visibility.entire_thread_visible_for_user?(activity, user)
278 end
279
280 test "returns true if user following to author" do
281 author = insert(:user)
282 user = insert(:user)
283 Pleroma.User.follow(user, author)
284
285 activity =
286 insert(:note_activity,
287 note:
288 insert(:note,
289 user: author,
290 data: %{"to" => [user.ap_id]}
291 )
292 )
293
294 assert Visibility.entire_thread_visible_for_user?(activity, user)
295 end
296 end
297 end