1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Web.MastodonAPI.AccountControllerTest do
6 use Pleroma.Web.ConnCase
10 alias Pleroma.Web.ActivityPub.ActivityPub
11 alias Pleroma.Web.ActivityPub.InternalFetchActor
12 alias Pleroma.Web.CommonAPI
13 alias Pleroma.Web.OAuth.Token
14 alias Pleroma.Web.Plugs.SetLocalePlug
16 import Pleroma.Factory
18 describe "account fetching" do
20 %User{id: user_id} = insert(:user)
22 assert %{"id" => ^user_id} =
24 |> get("/api/v1/accounts/#{user_id}")
25 |> json_response_and_validate_schema(200)
27 assert %{"error" => "Can't find user"} =
29 |> get("/api/v1/accounts/-1")
30 |> json_response_and_validate_schema(404)
33 test "relationship field" do
34 %{conn: conn, user: user} = oauth_access(["read"])
36 other_user = insert(:user)
40 |> get("/api/v1/accounts/#{other_user.id}")
41 |> json_response_and_validate_schema(200)
43 assert response["id"] == other_user.id
44 assert response["pleroma"]["relationship"] == %{}
46 assert %{"pleroma" => %{"relationship" => %{"following" => false, "followed_by" => false}}} =
48 |> get("/api/v1/accounts/#{other_user.id}?with_relationships=true")
49 |> json_response_and_validate_schema(200)
51 {:ok, _, %{id: other_id}} = User.follow(user, other_user)
55 "pleroma" => %{"relationship" => %{"following" => true, "followed_by" => false}}
58 |> get("/api/v1/accounts/#{other_id}?with_relationships=true")
59 |> json_response_and_validate_schema(200)
61 {:ok, _, _} = User.follow(other_user, user)
65 "pleroma" => %{"relationship" => %{"following" => true, "followed_by" => true}}
68 |> get("/api/v1/accounts/#{other_id}?with_relationships=true")
69 |> json_response_and_validate_schema(200)
72 test "works by nickname" do
75 assert %{"id" => _user_id} =
77 |> get("/api/v1/accounts/#{user.nickname}")
78 |> json_response_and_validate_schema(200)
81 test "works by nickname for remote users" do
82 clear_config([:instance, :limit_to_local_content], false)
84 user = insert(:user, nickname: "user@example.com", local: false)
86 assert %{"id" => _user_id} =
88 |> get("/api/v1/accounts/#{user.nickname}")
89 |> json_response_and_validate_schema(200)
92 test "respects limit_to_local_content == :all for remote user nicknames" do
93 clear_config([:instance, :limit_to_local_content], :all)
95 user = insert(:user, nickname: "user@example.com", local: false)
98 |> get("/api/v1/accounts/#{user.nickname}")
99 |> json_response_and_validate_schema(404)
102 test "respects limit_to_local_content == :unauthenticated for remote user nicknames" do
103 clear_config([:instance, :limit_to_local_content], :unauthenticated)
105 user = insert(:user, nickname: "user@example.com", local: false)
106 reading_user = insert(:user)
110 |> get("/api/v1/accounts/#{user.nickname}")
112 assert json_response_and_validate_schema(conn, 404)
116 |> assign(:user, reading_user)
117 |> assign(:token, insert(:oauth_token, user: reading_user, scopes: ["read:accounts"]))
118 |> get("/api/v1/accounts/#{user.nickname}")
120 assert %{"id" => id} = json_response_and_validate_schema(conn, 200)
124 test "accounts fetches correct account for nicknames beginning with numbers", %{conn: conn} do
125 # Need to set an old-style integer ID to reproduce the problem
126 # (these are no longer assigned to new accounts but were preserved
127 # for existing accounts during the migration to flakeIDs)
128 user_one = insert(:user, %{id: 1212})
129 user_two = insert(:user, %{nickname: "#{user_one.id}garbage"})
133 |> get("/api/v1/accounts/#{user_one.id}")
134 |> json_response_and_validate_schema(:ok)
138 |> get("/api/v1/accounts/#{user_two.nickname}")
139 |> json_response_and_validate_schema(:ok)
143 |> get("/api/v1/accounts/#{user_two.id}")
144 |> json_response_and_validate_schema(:ok)
146 refute acc_one == acc_two
147 assert acc_two == acc_three
150 test "returns 404 when user is invisible", %{conn: conn} do
151 user = insert(:user, %{invisible: true})
153 assert %{"error" => "Can't find user"} =
155 |> get("/api/v1/accounts/#{user.nickname}")
156 |> json_response_and_validate_schema(404)
159 test "returns 404 for internal.fetch actor", %{conn: conn} do
160 %User{nickname: "internal.fetch"} = InternalFetchActor.get_actor()
162 assert %{"error" => "Can't find user"} =
164 |> get("/api/v1/accounts/internal.fetch")
165 |> json_response_and_validate_schema(404)
168 test "returns 404 for deactivated user", %{conn: conn} do
169 user = insert(:user, is_active: false)
171 assert %{"error" => "Can't find user"} =
173 |> get("/api/v1/accounts/#{user.id}")
174 |> json_response_and_validate_schema(:not_found)
178 defp local_and_remote_users do
179 local = insert(:user)
180 remote = insert(:user, local: false)
181 {:ok, local: local, remote: remote}
184 describe "user fetching with restrict unauthenticated profiles for local and remote" do
185 setup do: local_and_remote_users()
187 setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
189 setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
191 test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
192 assert %{"error" => "This API requires an authenticated user"} ==
194 |> get("/api/v1/accounts/#{local.id}")
195 |> json_response_and_validate_schema(:unauthorized)
197 assert %{"error" => "This API requires an authenticated user"} ==
199 |> get("/api/v1/accounts/#{remote.id}")
200 |> json_response_and_validate_schema(:unauthorized)
203 test "if user is authenticated", %{local: local, remote: remote} do
204 %{conn: conn} = oauth_access(["read"])
206 res_conn = get(conn, "/api/v1/accounts/#{local.id}")
207 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
209 res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
210 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
214 describe "user fetching with restrict unauthenticated profiles for local" do
215 setup do: local_and_remote_users()
217 setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
219 test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
220 res_conn = get(conn, "/api/v1/accounts/#{local.id}")
222 assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
223 "error" => "This API requires an authenticated user"
226 res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
227 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
230 test "if user is authenticated", %{local: local, remote: remote} do
231 %{conn: conn} = oauth_access(["read"])
233 res_conn = get(conn, "/api/v1/accounts/#{local.id}")
234 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
236 res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
237 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
241 describe "user fetching with restrict unauthenticated profiles for remote" do
242 setup do: local_and_remote_users()
244 setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
246 test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
247 res_conn = get(conn, "/api/v1/accounts/#{local.id}")
248 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
250 res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
252 assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
253 "error" => "This API requires an authenticated user"
257 test "if user is authenticated", %{local: local, remote: remote} do
258 %{conn: conn} = oauth_access(["read"])
260 res_conn = get(conn, "/api/v1/accounts/#{local.id}")
261 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
263 res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
264 assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
268 describe "user timelines" do
269 setup do: oauth_access(["read:statuses"])
271 test "works with announces that are just addressed to public", %{conn: conn} do
272 user = insert(:user, ap_id: "https://honktest/u/test", local: false)
273 other_user = insert(:user)
275 {:ok, post} = CommonAPI.post(other_user, %{status: "bonkeronk"})
279 "@context" => "https://www.w3.org/ns/activitystreams",
280 "actor" => "https://honktest/u/test",
281 "id" => "https://honktest/u/test/bonk/1793M7B9MQ48847vdx",
282 "object" => post.data["object"],
283 "published" => "2019-06-25T19:33:58Z",
284 "to" => ["https://www.w3.org/ns/activitystreams#Public"],
287 |> ActivityPub.persist(local: false)
291 |> get("/api/v1/accounts/#{user.id}/statuses")
292 |> json_response_and_validate_schema(200)
294 assert [%{"id" => id}] = resp
295 assert id == announce.id
298 test "deactivated user", %{conn: conn} do
299 user = insert(:user, is_active: false)
301 assert %{"error" => "Can't find user"} ==
303 |> get("/api/v1/accounts/#{user.id}/statuses")
304 |> json_response_and_validate_schema(:not_found)
307 test "returns 404 when user is invisible", %{conn: conn} do
308 user = insert(:user, %{invisible: true})
310 assert %{"error" => "Can't find user"} =
312 |> get("/api/v1/accounts/#{user.id}")
313 |> json_response_and_validate_schema(404)
316 test "respects blocks", %{user: user_one, conn: conn} do
317 user_two = insert(:user)
318 user_three = insert(:user)
320 User.block(user_one, user_two)
322 {:ok, activity} = CommonAPI.post(user_two, %{status: "User one sux0rz"})
323 {:ok, repeat} = CommonAPI.repeat(activity.id, user_three)
327 |> get("/api/v1/accounts/#{user_two.id}/statuses")
328 |> json_response_and_validate_schema(200)
330 assert [%{"id" => id}] = resp
331 assert id == activity.id
333 # Even a blocked user will deliver the full user timeline, there would be
334 # no point in looking at a blocked users timeline otherwise
337 |> get("/api/v1/accounts/#{user_two.id}/statuses")
338 |> json_response_and_validate_schema(200)
340 assert [%{"id" => id}] = resp
341 assert id == activity.id
343 # Third user's timeline includes the repeat when viewed by unauthenticated user
346 |> get("/api/v1/accounts/#{user_three.id}/statuses")
347 |> json_response_and_validate_schema(200)
349 assert [%{"id" => id}] = resp
350 assert id == repeat.id
352 # When viewing a third user's timeline, the blocked users' statuses will NOT be shown
353 resp = get(conn, "/api/v1/accounts/#{user_three.id}/statuses")
355 assert [] == json_response_and_validate_schema(resp, 200)
358 test "gets users statuses", %{conn: conn} do
359 user_one = insert(:user)
360 user_two = insert(:user)
361 user_three = insert(:user)
363 {:ok, _user_three, _user_one} = User.follow(user_three, user_one)
365 {:ok, activity} = CommonAPI.post(user_one, %{status: "HI!!!"})
367 {:ok, direct_activity} =
368 CommonAPI.post(user_one, %{
369 status: "Hi, @#{user_two.nickname}.",
373 {:ok, private_activity} =
374 CommonAPI.post(user_one, %{status: "private", visibility: "private"})
379 |> get("/api/v1/accounts/#{user_one.id}/statuses")
380 |> json_response_and_validate_schema(200)
382 assert [%{"id" => id}] = resp
383 assert id == to_string(activity.id)
387 |> assign(:user, user_two)
388 |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
389 |> get("/api/v1/accounts/#{user_one.id}/statuses")
390 |> json_response_and_validate_schema(200)
392 assert [%{"id" => id_one}, %{"id" => id_two}] = resp
393 assert id_one == to_string(direct_activity.id)
394 assert id_two == to_string(activity.id)
398 |> assign(:user, user_three)
399 |> assign(:token, insert(:oauth_token, user: user_three, scopes: ["read:statuses"]))
400 |> get("/api/v1/accounts/#{user_one.id}/statuses")
401 |> json_response_and_validate_schema(200)
403 assert [%{"id" => id_one}, %{"id" => id_two}] = resp
404 assert id_one == to_string(private_activity.id)
405 assert id_two == to_string(activity.id)
408 test "unimplemented pinned statuses feature", %{conn: conn} do
409 note = insert(:note_activity)
410 user = User.get_cached_by_ap_id(note.data["actor"])
412 conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?pinned=true")
414 assert json_response_and_validate_schema(conn, 200) == []
417 test "gets local-only statuses for authenticated users", %{user: _user, conn: conn} do
418 user_one = insert(:user)
420 {:ok, activity} = CommonAPI.post(user_one, %{status: "HI!!!", visibility: "local"})
424 |> get("/api/v1/accounts/#{user_one.id}/statuses")
425 |> json_response_and_validate_schema(200)
427 assert [%{"id" => id}] = resp
428 assert id == to_string(activity.id)
431 test "gets an users media, excludes reblogs", %{conn: conn} do
432 note = insert(:note_activity)
433 user = User.get_cached_by_ap_id(note.data["actor"])
434 other_user = insert(:user)
437 content_type: "image/jpeg",
438 path: Path.absname("test/fixtures/image.jpg"),
439 filename: "an_image.jpg"
442 {:ok, %{id: media_id}} = ActivityPub.upload(file, actor: user.ap_id)
444 {:ok, %{id: image_post_id}} = CommonAPI.post(user, %{status: "cofe", media_ids: [media_id]})
446 {:ok, %{id: media_id}} = ActivityPub.upload(file, actor: other_user.ap_id)
448 {:ok, %{id: other_image_post_id}} =
449 CommonAPI.post(other_user, %{status: "cofe2", media_ids: [media_id]})
451 {:ok, _announce} = CommonAPI.repeat(other_image_post_id, user)
453 conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?only_media=true")
455 assert [%{"id" => ^image_post_id}] = json_response_and_validate_schema(conn, 200)
457 conn = get(build_conn(), "/api/v1/accounts/#{user.id}/statuses?only_media=1")
459 assert [%{"id" => ^image_post_id}] = json_response_and_validate_schema(conn, 200)
462 test "gets a user's statuses without reblogs", %{user: user, conn: conn} do
463 {:ok, %{id: post_id}} = CommonAPI.post(user, %{status: "HI!!!"})
464 {:ok, _} = CommonAPI.repeat(post_id, user)
466 conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_reblogs=true")
467 assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)
469 conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_reblogs=1")
470 assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)
473 test "filters user's statuses by a hashtag", %{user: user, conn: conn} do
474 {:ok, %{id: post_id}} = CommonAPI.post(user, %{status: "#hashtag"})
475 {:ok, _post} = CommonAPI.post(user, %{status: "hashtag"})
477 conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?tagged=hashtag")
478 assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)
481 test "the user views their own timelines and excludes direct messages", %{
485 {:ok, %{id: public_activity_id}} =
486 CommonAPI.post(user, %{status: ".", visibility: "public"})
488 {:ok, _direct_activity} = CommonAPI.post(user, %{status: ".", visibility: "direct"})
490 conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_visibilities[]=direct")
491 assert [%{"id" => ^public_activity_id}] = json_response_and_validate_schema(conn, 200)
494 test "muted reactions", %{user: user, conn: conn} do
495 user2 = insert(:user)
496 User.mute(user, user2)
497 {:ok, activity} = CommonAPI.post(user, %{status: "."})
498 {:ok, _} = CommonAPI.react_with_emoji(activity.id, user2, "🎅")
502 |> get("/api/v1/accounts/#{user.id}/statuses")
503 |> json_response_and_validate_schema(200)
508 "emoji_reactions" => []
515 |> get("/api/v1/accounts/#{user.id}/statuses?with_muted=true")
516 |> json_response_and_validate_schema(200)
521 "emoji_reactions" => [%{"count" => 1, "me" => false, "name" => "🎅"}]
527 test "paginates a user's statuses", %{user: user, conn: conn} do
528 {:ok, post_1} = CommonAPI.post(user, %{status: "first post"})
529 {:ok, post_2} = CommonAPI.post(user, %{status: "second post"})
531 response_1 = get(conn, "/api/v1/accounts/#{user.id}/statuses?limit=1")
532 assert [res] = json_response_and_validate_schema(response_1, 200)
533 assert res["id"] == post_2.id
535 response_2 = get(conn, "/api/v1/accounts/#{user.id}/statuses?limit=1&max_id=#{res["id"]}")
536 assert [res] = json_response_and_validate_schema(response_2, 200)
537 assert res["id"] == post_1.id
539 refute response_1 == response_2
543 defp local_and_remote_activities(%{local: local, remote: remote}) do
544 insert(:note_activity, user: local)
545 insert(:note_activity, user: remote, local: false)
550 describe "statuses with restrict unauthenticated profiles for local and remote" do
551 setup do: local_and_remote_users()
552 setup :local_and_remote_activities
554 setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
556 setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
558 test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
559 assert %{"error" => "This API requires an authenticated user"} ==
561 |> get("/api/v1/accounts/#{local.id}/statuses")
562 |> json_response_and_validate_schema(:unauthorized)
564 assert %{"error" => "This API requires an authenticated user"} ==
566 |> get("/api/v1/accounts/#{remote.id}/statuses")
567 |> json_response_and_validate_schema(:unauthorized)
570 test "if user is authenticated", %{local: local, remote: remote} do
571 %{conn: conn} = oauth_access(["read"])
573 res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
574 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
576 res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
577 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
581 describe "statuses with restrict unauthenticated profiles for local" do
582 setup do: local_and_remote_users()
583 setup :local_and_remote_activities
585 setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
587 test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
588 assert %{"error" => "This API requires an authenticated user"} ==
590 |> get("/api/v1/accounts/#{local.id}/statuses")
591 |> json_response_and_validate_schema(:unauthorized)
593 res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
594 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
597 test "if user is authenticated", %{local: local, remote: remote} do
598 %{conn: conn} = oauth_access(["read"])
600 res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
601 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
603 res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
604 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
608 describe "statuses with restrict unauthenticated profiles for remote" do
609 setup do: local_and_remote_users()
610 setup :local_and_remote_activities
612 setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
614 test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
615 res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
616 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
618 assert %{"error" => "This API requires an authenticated user"} ==
620 |> get("/api/v1/accounts/#{remote.id}/statuses")
621 |> json_response_and_validate_schema(:unauthorized)
624 test "if user is authenticated", %{local: local, remote: remote} do
625 %{conn: conn} = oauth_access(["read"])
627 res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
628 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
630 res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
631 assert length(json_response_and_validate_schema(res_conn, 200)) == 1
635 describe "followers" do
636 setup do: oauth_access(["read:accounts"])
638 test "getting followers", %{user: user, conn: conn} do
639 other_user = insert(:user)
640 {:ok, %{id: user_id}, other_user} = User.follow(user, other_user)
642 conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")
644 assert [%{"id" => ^user_id}] = json_response_and_validate_schema(conn, 200)
647 test "following with relationship", %{conn: conn, user: user} do
648 other_user = insert(:user)
649 {:ok, %{id: id}, _} = User.follow(other_user, user)
657 "following" => false,
658 "followed_by" => true
664 |> get("/api/v1/accounts/#{user.id}/followers?with_relationships=true")
665 |> json_response_and_validate_schema(200)
667 {:ok, _, _} = User.follow(user, other_user)
676 "followed_by" => true
682 |> get("/api/v1/accounts/#{user.id}/followers?with_relationships=true")
683 |> json_response_and_validate_schema(200)
686 test "getting followers, hide_followers", %{user: user, conn: conn} do
687 other_user = insert(:user, hide_followers: true)
688 {:ok, _user, _other_user} = User.follow(user, other_user)
690 conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")
692 assert [] == json_response_and_validate_schema(conn, 200)
695 test "getting followers, hide_followers, same user requesting" do
697 other_user = insert(:user, hide_followers: true)
698 {:ok, _user, _other_user} = User.follow(user, other_user)
702 |> assign(:user, other_user)
703 |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
704 |> get("/api/v1/accounts/#{other_user.id}/followers")
706 refute [] == json_response_and_validate_schema(conn, 200)
709 test "getting followers, pagination", %{user: user, conn: conn} do
710 {:ok, %User{id: follower1_id}, _user} = :user |> insert() |> User.follow(user)
711 {:ok, %User{id: follower2_id}, _user} = :user |> insert() |> User.follow(user)
712 {:ok, %User{id: follower3_id}, _user} = :user |> insert() |> User.follow(user)
714 assert [%{"id" => ^follower3_id}, %{"id" => ^follower2_id}] =
716 |> get("/api/v1/accounts/#{user.id}/followers?since_id=#{follower1_id}")
717 |> json_response_and_validate_schema(200)
719 assert [%{"id" => ^follower2_id}, %{"id" => ^follower1_id}] =
721 |> get("/api/v1/accounts/#{user.id}/followers?max_id=#{follower3_id}")
722 |> json_response_and_validate_schema(200)
724 assert [%{"id" => ^follower2_id}, %{"id" => ^follower1_id}] =
727 "/api/v1/accounts/#{user.id}/followers?id=#{user.id}&limit=20&max_id=#{follower3_id}"
729 |> json_response_and_validate_schema(200)
731 res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?limit=1&max_id=#{follower3_id}")
733 assert [%{"id" => ^follower2_id}] = json_response_and_validate_schema(res_conn, 200)
735 assert [link_header] = get_resp_header(res_conn, "link")
736 assert link_header =~ ~r/min_id=#{follower2_id}/
737 assert link_header =~ ~r/max_id=#{follower2_id}/
741 describe "following" do
742 setup do: oauth_access(["read:accounts"])
744 test "getting following", %{user: user, conn: conn} do
745 other_user = insert(:user)
746 {:ok, user, other_user} = User.follow(user, other_user)
748 conn = get(conn, "/api/v1/accounts/#{user.id}/following")
750 assert [%{"id" => id}] = json_response_and_validate_schema(conn, 200)
751 assert id == to_string(other_user.id)
754 test "following with relationship", %{conn: conn, user: user} do
755 other_user = insert(:user)
756 {:ok, user, other_user} = User.follow(user, other_user)
758 conn = get(conn, "/api/v1/accounts/#{user.id}/following?with_relationships=true")
766 "relationship" => %{"id" => ^id, "following" => true, "followed_by" => false}
769 ] = json_response_and_validate_schema(conn, 200)
772 test "getting following, hide_follows, other user requesting" do
773 user = insert(:user, hide_follows: true)
774 other_user = insert(:user)
775 {:ok, user, other_user} = User.follow(user, other_user)
779 |> assign(:user, other_user)
780 |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
781 |> get("/api/v1/accounts/#{user.id}/following")
783 assert [] == json_response_and_validate_schema(conn, 200)
786 test "getting following, hide_follows, same user requesting" do
787 user = insert(:user, hide_follows: true)
788 other_user = insert(:user)
789 {:ok, user, _other_user} = User.follow(user, other_user)
793 |> assign(:user, user)
794 |> assign(:token, insert(:oauth_token, user: user, scopes: ["read:accounts"]))
795 |> get("/api/v1/accounts/#{user.id}/following")
797 refute [] == json_response_and_validate_schema(conn, 200)
800 test "getting following, pagination", %{user: user, conn: conn} do
801 following1 = insert(:user)
802 following2 = insert(:user)
803 following3 = insert(:user)
804 {:ok, _, _} = User.follow(user, following1)
805 {:ok, _, _} = User.follow(user, following2)
806 {:ok, _, _} = User.follow(user, following3)
808 res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?since_id=#{following1.id}")
810 assert [%{"id" => id3}, %{"id" => id2}] = json_response_and_validate_schema(res_conn, 200)
811 assert id3 == following3.id
812 assert id2 == following2.id
814 res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?max_id=#{following3.id}")
816 assert [%{"id" => id2}, %{"id" => id1}] = json_response_and_validate_schema(res_conn, 200)
817 assert id2 == following2.id
818 assert id1 == following1.id
823 "/api/v1/accounts/#{user.id}/following?id=#{user.id}&limit=20&max_id=#{following3.id}"
826 assert [%{"id" => id2}, %{"id" => id1}] = json_response_and_validate_schema(res_conn, 200)
827 assert id2 == following2.id
828 assert id1 == following1.id
831 get(conn, "/api/v1/accounts/#{user.id}/following?limit=1&max_id=#{following3.id}")
833 assert [%{"id" => id2}] = json_response_and_validate_schema(res_conn, 200)
834 assert id2 == following2.id
836 assert [link_header] = get_resp_header(res_conn, "link")
837 assert link_header =~ ~r/min_id=#{following2.id}/
838 assert link_header =~ ~r/max_id=#{following2.id}/
842 describe "follow/unfollow" do
843 setup do: oauth_access(["follow"])
845 test "following / unfollowing a user", %{conn: conn} do
846 %{id: other_user_id, nickname: other_user_nickname} = insert(:user)
848 assert %{"id" => _id, "following" => true} =
850 |> post("/api/v1/accounts/#{other_user_id}/follow")
851 |> json_response_and_validate_schema(200)
853 assert %{"id" => _id, "following" => false} =
855 |> post("/api/v1/accounts/#{other_user_id}/unfollow")
856 |> json_response_and_validate_schema(200)
858 assert %{"id" => ^other_user_id} =
860 |> put_req_header("content-type", "application/json")
861 |> post("/api/v1/follows", %{"uri" => other_user_nickname})
862 |> json_response_and_validate_schema(200)
865 test "cancelling follow request", %{conn: conn} do
866 %{id: other_user_id} = insert(:user, %{is_locked: true})
868 assert %{"id" => ^other_user_id, "following" => false, "requested" => true} =
870 |> post("/api/v1/accounts/#{other_user_id}/follow")
871 |> json_response_and_validate_schema(:ok)
873 assert %{"id" => ^other_user_id, "following" => false, "requested" => false} =
875 |> post("/api/v1/accounts/#{other_user_id}/unfollow")
876 |> json_response_and_validate_schema(:ok)
879 test "following without reblogs" do
880 %{conn: conn} = oauth_access(["follow", "read:statuses"])
881 followed = insert(:user)
882 other_user = insert(:user)
886 |> put_req_header("content-type", "application/json")
887 |> post("/api/v1/accounts/#{followed.id}/follow", %{reblogs: false})
889 assert %{"showing_reblogs" => false} = json_response_and_validate_schema(ret_conn, 200)
891 {:ok, activity} = CommonAPI.post(other_user, %{status: "hey"})
892 {:ok, %{id: reblog_id}} = CommonAPI.repeat(activity.id, followed)
896 |> get("/api/v1/timelines/home")
897 |> json_response_and_validate_schema(200)
899 assert %{"showing_reblogs" => true} =
901 |> put_req_header("content-type", "application/json")
902 |> post("/api/v1/accounts/#{followed.id}/follow", %{reblogs: true})
903 |> json_response_and_validate_schema(200)
905 assert %{"showing_reblogs" => true} =
907 |> put_req_header("content-type", "application/json")
908 |> post("/api/v1/accounts/#{followed.id}/follow", %{reblogs: "1"})
909 |> json_response_and_validate_schema(200)
911 assert [%{"id" => ^reblog_id}] =
913 |> get("/api/v1/timelines/home")
914 |> json_response_and_validate_schema(200)
917 test "following with reblogs" do
918 %{conn: conn} = oauth_access(["follow", "read:statuses"])
919 followed = insert(:user)
920 other_user = insert(:user)
922 ret_conn = post(conn, "/api/v1/accounts/#{followed.id}/follow")
924 assert %{"showing_reblogs" => true} = json_response_and_validate_schema(ret_conn, 200)
926 {:ok, activity} = CommonAPI.post(other_user, %{status: "hey"})
927 {:ok, %{id: reblog_id}} = CommonAPI.repeat(activity.id, followed)
929 assert [%{"id" => ^reblog_id}] =
931 |> get("/api/v1/timelines/home")
932 |> json_response_and_validate_schema(200)
934 assert %{"showing_reblogs" => false} =
936 |> put_req_header("content-type", "application/json")
937 |> post("/api/v1/accounts/#{followed.id}/follow", %{reblogs: false})
938 |> json_response_and_validate_schema(200)
940 assert %{"showing_reblogs" => false} =
942 |> put_req_header("content-type", "application/json")
943 |> post("/api/v1/accounts/#{followed.id}/follow", %{reblogs: "0"})
944 |> json_response_and_validate_schema(200)
948 |> get("/api/v1/timelines/home")
949 |> json_response_and_validate_schema(200)
952 test "following with subscription and unsubscribing" do
953 %{conn: conn} = oauth_access(["follow"])
954 followed = insert(:user)
956 assert %{"subscribing" => true} =
958 |> put_req_header("content-type", "application/json")
959 |> post("/api/v1/accounts/#{followed.id}/follow", %{notify: true})
960 |> json_response_and_validate_schema(200)
962 assert %{"subscribing" => true} =
964 |> put_req_header("content-type", "application/json")
965 |> post("/api/v1/accounts/#{followed.id}/follow", %{notify: "1"})
966 |> json_response_and_validate_schema(200)
968 assert %{"subscribing" => false} =
970 |> put_req_header("content-type", "application/json")
971 |> post("/api/v1/accounts/#{followed.id}/follow", %{notify: false})
972 |> json_response_and_validate_schema(200)
975 test "following / unfollowing errors", %{user: user, conn: conn} do
977 conn_res = post(conn, "/api/v1/accounts/#{user.id}/follow")
979 assert %{"error" => "Can not follow yourself"} =
980 json_response_and_validate_schema(conn_res, 400)
983 user = User.get_cached_by_id(user.id)
984 conn_res = post(conn, "/api/v1/accounts/#{user.id}/unfollow")
986 assert %{"error" => "Can not unfollow yourself"} =
987 json_response_and_validate_schema(conn_res, 400)
989 # self follow via uri
990 user = User.get_cached_by_id(user.id)
992 assert %{"error" => "Can not follow yourself"} =
994 |> put_req_header("content-type", "multipart/form-data")
995 |> post("/api/v1/follows", %{"uri" => user.nickname})
996 |> json_response_and_validate_schema(400)
998 # follow non existing user
999 conn_res = post(conn, "/api/v1/accounts/doesntexist/follow")
1000 assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)
1002 # follow non existing user via uri
1005 |> put_req_header("content-type", "multipart/form-data")
1006 |> post("/api/v1/follows", %{"uri" => "doesntexist"})
1008 assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)
1010 # unfollow non existing user
1011 conn_res = post(conn, "/api/v1/accounts/doesntexist/unfollow")
1012 assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)
1016 describe "mute/unmute" do
1017 setup do: oauth_access(["write:mutes"])
1019 test "with notifications", %{conn: conn} do
1020 other_user = insert(:user)
1022 assert %{"id" => _id, "muting" => true, "muting_notifications" => true} =
1024 |> post("/api/v1/accounts/#{other_user.id}/mute")
1025 |> json_response_and_validate_schema(200)
1027 conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")
1029 assert %{"id" => _id, "muting" => false, "muting_notifications" => false} =
1030 json_response_and_validate_schema(conn, 200)
1033 test "without notifications", %{conn: conn} do
1034 other_user = insert(:user)
1038 |> put_req_header("content-type", "multipart/form-data")
1039 |> post("/api/v1/accounts/#{other_user.id}/mute", %{"notifications" => "false"})
1041 assert %{"id" => _id, "muting" => true, "muting_notifications" => false} =
1042 json_response_and_validate_schema(ret_conn, 200)
1044 conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")
1046 assert %{"id" => _id, "muting" => false, "muting_notifications" => false} =
1047 json_response_and_validate_schema(conn, 200)
1051 describe "pinned statuses" do
1053 user = insert(:user)
1054 {:ok, activity} = CommonAPI.post(user, %{status: "HI!!!"})
1055 %{conn: conn} = oauth_access(["read:statuses"], user: user)
1057 [conn: conn, user: user, activity: activity]
1060 test "returns pinned statuses", %{conn: conn, user: user, activity: %{id: activity_id}} do
1061 {:ok, _} = CommonAPI.pin(activity_id, user)
1063 assert [%{"id" => ^activity_id, "pinned" => true}] =
1065 |> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
1066 |> json_response_and_validate_schema(200)
1070 test "blocking / unblocking a user" do
1071 %{conn: conn} = oauth_access(["follow"])
1072 other_user = insert(:user)
1074 ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/block")
1076 assert %{"id" => _id, "blocking" => true} = json_response_and_validate_schema(ret_conn, 200)
1078 conn = post(conn, "/api/v1/accounts/#{other_user.id}/unblock")
1080 assert %{"id" => _id, "blocking" => false} = json_response_and_validate_schema(conn, 200)
1083 describe "create account by app" do
1087 email: "lain@example.org",
1088 password: "PlzDontHackLain",
1092 [valid_params: valid_params]
1095 test "registers and logs in without :account_activation_required / :account_approval_required",
1097 clear_config([:instance, :account_activation_required], false)
1098 clear_config([:instance, :account_approval_required], false)
1102 |> put_req_header("content-type", "application/json")
1103 |> post("/api/v1/apps", %{
1104 client_name: "client_name",
1105 redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
1106 scopes: "read, write, follow"
1110 "client_id" => client_id,
1111 "client_secret" => client_secret,
1113 "name" => "client_name",
1114 "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
1117 } = json_response_and_validate_schema(conn, 200)
1120 post(conn, "/oauth/token", %{
1121 grant_type: "client_credentials",
1122 client_id: client_id,
1123 client_secret: client_secret
1126 assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
1127 json_response(conn, 200)
1130 token_from_db = Repo.get_by(Token, token: token)
1131 assert token_from_db
1133 assert scope == "read write follow"
1135 clear_config([User, :email_blacklist], ["example.org"])
1139 email: "lain@example.org",
1140 password: "PlzDontHackLain",
1147 |> put_req_header("content-type", "multipart/form-data")
1148 |> put_req_header("authorization", "Bearer " <> token)
1149 |> post("/api/v1/accounts", params)
1151 assert %{"error" => "{\"email\":[\"Invalid email\"]}"} =
1152 json_response_and_validate_schema(conn, 400)
1154 clear_config([User, :email_blacklist], [])
1158 |> put_req_header("content-type", "multipart/form-data")
1159 |> put_req_header("authorization", "Bearer " <> token)
1160 |> post("/api/v1/accounts", params)
1163 "access_token" => token,
1164 "created_at" => _created_at,
1166 "token_type" => "Bearer"
1167 } = json_response_and_validate_schema(conn, 200)
1169 token_from_db = Repo.get_by(Token, token: token)
1170 assert token_from_db
1171 user = Repo.preload(token_from_db, :user).user
1174 assert user.is_confirmed
1175 assert user.is_approved
1178 test "registers but does not log in with :account_activation_required", %{conn: conn} do
1179 clear_config([:instance, :account_activation_required], true)
1180 clear_config([:instance, :account_approval_required], false)
1184 |> put_req_header("content-type", "application/json")
1185 |> post("/api/v1/apps", %{
1186 client_name: "client_name",
1187 redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
1188 scopes: "read, write, follow"
1192 "client_id" => client_id,
1193 "client_secret" => client_secret,
1195 "name" => "client_name",
1196 "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
1199 } = json_response_and_validate_schema(conn, 200)
1202 post(conn, "/oauth/token", %{
1203 grant_type: "client_credentials",
1204 client_id: client_id,
1205 client_secret: client_secret
1208 assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
1209 json_response(conn, 200)
1212 token_from_db = Repo.get_by(Token, token: token)
1213 assert token_from_db
1215 assert scope == "read write follow"
1219 |> put_req_header("content-type", "multipart/form-data")
1220 |> put_req_header("authorization", "Bearer " <> token)
1221 |> post("/api/v1/accounts", %{
1223 email: "lain@example.org",
1224 password: "PlzDontHackLain",
1229 response = json_response_and_validate_schema(conn, 200)
1230 assert %{"identifier" => "missing_confirmed_email"} = response
1231 refute response["access_token"]
1232 refute response["token_type"]
1234 user = Repo.get_by(User, email: "lain@example.org")
1235 refute user.is_confirmed
1238 test "registers but does not log in with :account_approval_required", %{conn: conn} do
1239 clear_config([:instance, :account_approval_required], true)
1240 clear_config([:instance, :account_activation_required], false)
1244 |> put_req_header("content-type", "application/json")
1245 |> post("/api/v1/apps", %{
1246 client_name: "client_name",
1247 redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
1248 scopes: "read, write, follow"
1252 "client_id" => client_id,
1253 "client_secret" => client_secret,
1255 "name" => "client_name",
1256 "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
1259 } = json_response_and_validate_schema(conn, 200)
1262 post(conn, "/oauth/token", %{
1263 grant_type: "client_credentials",
1264 client_id: client_id,
1265 client_secret: client_secret
1268 assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
1269 json_response(conn, 200)
1272 token_from_db = Repo.get_by(Token, token: token)
1273 assert token_from_db
1275 assert scope == "read write follow"
1279 |> put_req_header("content-type", "multipart/form-data")
1280 |> put_req_header("authorization", "Bearer " <> token)
1281 |> post("/api/v1/accounts", %{
1283 email: "lain@example.org",
1284 password: "PlzDontHackLain",
1287 reason: "I'm a cool dude, bro"
1290 response = json_response_and_validate_schema(conn, 200)
1291 assert %{"identifier" => "awaiting_approval"} = response
1292 refute response["access_token"]
1293 refute response["token_type"]
1295 user = Repo.get_by(User, email: "lain@example.org")
1297 refute user.is_approved
1298 assert user.registration_reason == "I'm a cool dude, bro"
1301 test "returns error when user already registred", %{conn: conn, valid_params: valid_params} do
1302 _user = insert(:user, email: "lain@example.org")
1303 app_token = insert(:oauth_token, user: nil)
1307 |> put_req_header("authorization", "Bearer " <> app_token.token)
1308 |> put_req_header("content-type", "application/json")
1309 |> post("/api/v1/accounts", valid_params)
1311 assert json_response_and_validate_schema(res, 400) == %{
1312 "error" => "{\"email\":[\"has already been taken\"]}"
1316 test "returns bad_request if missing required params", %{
1318 valid_params: valid_params
1320 app_token = insert(:oauth_token, user: nil)
1324 |> put_req_header("authorization", "Bearer " <> app_token.token)
1325 |> put_req_header("content-type", "application/json")
1327 res = post(conn, "/api/v1/accounts", valid_params)
1328 assert json_response_and_validate_schema(res, 200)
1330 [{127, 0, 0, 1}, {127, 0, 0, 2}, {127, 0, 0, 3}, {127, 0, 0, 4}]
1331 |> Stream.zip(Map.delete(valid_params, :email))
1332 |> Enum.each(fn {ip, {attr, _}} ->
1335 |> Map.put(:remote_ip, ip)
1336 |> post("/api/v1/accounts", Map.delete(valid_params, attr))
1337 |> json_response_and_validate_schema(400)
1340 "error" => "Missing field: #{attr}.",
1343 "message" => "Missing field: #{attr}",
1344 "source" => %{"pointer" => "/#{attr}"},
1345 "title" => "Invalid value"
1352 test "returns bad_request if missing email params when :account_activation_required is enabled",
1353 %{conn: conn, valid_params: valid_params} do
1354 clear_config([:instance, :account_activation_required], true)
1356 app_token = insert(:oauth_token, user: nil)
1360 |> put_req_header("authorization", "Bearer " <> app_token.token)
1361 |> put_req_header("content-type", "application/json")
1365 |> Map.put(:remote_ip, {127, 0, 0, 5})
1366 |> post("/api/v1/accounts", Map.delete(valid_params, :email))
1368 assert json_response_and_validate_schema(res, 400) ==
1369 %{"error" => "Missing parameter: email"}
1373 |> Map.put(:remote_ip, {127, 0, 0, 6})
1374 |> post("/api/v1/accounts", Map.put(valid_params, :email, ""))
1376 assert json_response_and_validate_schema(res, 400) == %{
1377 "error" => "{\"email\":[\"can't be blank\"]}"
1381 test "allow registration without an email", %{conn: conn, valid_params: valid_params} do
1382 app_token = insert(:oauth_token, user: nil)
1383 conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
1387 |> put_req_header("content-type", "application/json")
1388 |> Map.put(:remote_ip, {127, 0, 0, 7})
1389 |> post("/api/v1/accounts", Map.delete(valid_params, :email))
1391 assert json_response_and_validate_schema(res, 200)
1394 test "allow registration with an empty email", %{conn: conn, valid_params: valid_params} do
1395 app_token = insert(:oauth_token, user: nil)
1396 conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
1400 |> put_req_header("content-type", "application/json")
1401 |> Map.put(:remote_ip, {127, 0, 0, 8})
1402 |> post("/api/v1/accounts", Map.put(valid_params, :email, ""))
1404 assert json_response_and_validate_schema(res, 200)
1407 test "returns forbidden if token is invalid", %{conn: conn, valid_params: valid_params} do
1410 |> put_req_header("authorization", "Bearer " <> "invalid-token")
1411 |> put_req_header("content-type", "multipart/form-data")
1412 |> post("/api/v1/accounts", valid_params)
1414 assert json_response_and_validate_schema(res, 403) == %{"error" => "Invalid credentials"}
1417 test "registration from trusted app" do
1418 clear_config([Pleroma.Captcha, :enabled], true)
1419 app = insert(:oauth_app, trusted: true, scopes: ["read", "write", "follow", "push"])
1423 |> post("/oauth/token", %{
1424 "grant_type" => "client_credentials",
1425 "client_id" => app.client_id,
1426 "client_secret" => app.client_secret
1429 assert %{"access_token" => token, "token_type" => "Bearer"} = json_response(conn, 200)
1433 |> Plug.Conn.put_req_header("authorization", "Bearer " <> token)
1434 |> put_req_header("content-type", "multipart/form-data")
1435 |> post("/api/v1/accounts", %{
1436 nickname: "nickanme",
1438 email: "email@example.com",
1441 password: "some_password",
1442 confirm: "some_password"
1444 |> json_response_and_validate_schema(200)
1447 "access_token" => access_token,
1449 "scope" => "read write follow push",
1450 "token_type" => "Bearer"
1455 |> Plug.Conn.put_req_header("authorization", "Bearer " <> access_token)
1456 |> get("/api/v1/accounts/verify_credentials")
1457 |> json_response_and_validate_schema(200)
1462 "display_name" => "Lain",
1463 "follow_requests_count" => 0,
1464 "followers_count" => 0,
1465 "following_count" => 0,
1472 "actor_type" => "Person",
1473 "discoverable" => false,
1474 "no_rich_text" => false,
1477 "privacy" => "public",
1478 "sensitive" => false
1480 "statuses_count" => 0,
1481 "username" => "Lain"
1486 describe "create account by app / rate limit" do
1487 setup do: clear_config([:rate_limit, :app_account_creation], {10_000, 2})
1489 test "respects rate limit setting", %{conn: conn} do
1490 app_token = insert(:oauth_token, user: nil)
1494 |> put_req_header("authorization", "Bearer " <> app_token.token)
1495 |> Map.put(:remote_ip, {15, 15, 15, 15})
1496 |> put_req_header("content-type", "multipart/form-data")
1501 |> post("/api/v1/accounts", %{
1502 username: "#{i}lain",
1503 email: "#{i}lain@example.org",
1504 password: "PlzDontHackLain",
1509 "access_token" => token,
1510 "created_at" => _created_at,
1512 "token_type" => "Bearer"
1513 } = json_response_and_validate_schema(conn, 200)
1515 token_from_db = Repo.get_by(Token, token: token)
1516 assert token_from_db
1517 token_from_db = Repo.preload(token_from_db, :user)
1518 assert token_from_db.user
1522 post(conn, "/api/v1/accounts", %{
1524 email: "6lain@example.org",
1525 password: "PlzDontHackLain",
1529 assert json_response_and_validate_schema(conn, :too_many_requests) == %{
1530 "error" => "Throttled"
1535 describe "create account with enabled captcha" do
1536 setup %{conn: conn} do
1537 app_token = insert(:oauth_token, user: nil)
1541 |> put_req_header("authorization", "Bearer " <> app_token.token)
1542 |> put_req_header("content-type", "multipart/form-data")
1547 setup do: clear_config([Pleroma.Captcha, :enabled], true)
1549 test "creates an account and returns 200 if captcha is valid", %{conn: conn} do
1550 %{token: token, answer_data: answer_data} = Pleroma.Captcha.new()
1554 email: "lain@example.org",
1555 password: "PlzDontHackLain",
1557 captcha_solution: Pleroma.Captcha.Mock.solution(),
1558 captcha_token: token,
1559 captcha_answer_data: answer_data
1563 "access_token" => access_token,
1566 "token_type" => "Bearer"
1569 |> post("/api/v1/accounts", params)
1570 |> json_response_and_validate_schema(:ok)
1572 assert Token |> Repo.get_by(token: access_token) |> Repo.preload(:user) |> Map.get(:user)
1575 test "returns 400 if any captcha field is not provided", %{conn: conn} do
1576 captcha_fields = [:captcha_solution, :captcha_token, :captcha_answer_data]
1580 email: "lain@example.org",
1581 password: "PlzDontHackLain",
1583 captcha_solution: "xx",
1584 captcha_token: "xx",
1585 captcha_answer_data: "xx"
1588 for field <- captcha_fields do
1590 "error" => "{\"captcha\":[\"Invalid CAPTCHA (Missing parameter: #{field})\"]}"
1595 |> post("/api/v1/accounts", Map.delete(valid_params, field))
1596 |> json_response_and_validate_schema(:bad_request)
1600 test "returns an error if captcha is invalid", %{conn: conn} do
1603 email: "lain@example.org",
1604 password: "PlzDontHackLain",
1606 captcha_solution: "cofe",
1607 captcha_token: "cofe",
1608 captcha_answer_data: "cofe"
1611 assert %{"error" => "{\"captcha\":[\"Invalid answer data\"]}"} ==
1613 |> post("/api/v1/accounts", params)
1614 |> json_response_and_validate_schema(:bad_request)
1618 describe "create account with language" do
1619 setup %{conn: conn} do
1620 app_token = insert(:oauth_token, user: nil)
1624 |> put_req_header("authorization", "Bearer " <> app_token.token)
1625 |> put_req_header("content-type", "multipart/form-data")
1626 |> put_req_cookie(SetLocalePlug.frontend_language_cookie_name(), "zh-Hans")
1627 |> SetLocalePlug.call([])
1632 test "creates an account with language parameter", %{conn: conn} do
1635 email: "foo@example.org",
1643 |> post("/api/v1/accounts", params)
1645 assert json_response_and_validate_schema(res, 200)
1647 assert %{language: "ru"} = Pleroma.User.get_by_nickname("foo")
1650 test "language parameter should be normalized", %{conn: conn} do
1653 email: "foo@example.org",
1661 |> post("/api/v1/accounts", params)
1663 assert json_response_and_validate_schema(res, 200)
1665 assert %{language: "ru_RU"} = Pleroma.User.get_by_nickname("foo")
1668 test "createing an account without language parameter should fallback to cookie/header language",
1672 email: "foo2@example.org",
1679 |> post("/api/v1/accounts", params)
1681 assert json_response_and_validate_schema(res, 200)
1683 assert %{language: "zh_Hans"} = Pleroma.User.get_by_nickname("foo2")
1687 describe "GET /api/v1/accounts/:id/lists - account_lists" do
1688 test "returns lists to which the account belongs" do
1689 %{user: user, conn: conn} = oauth_access(["read:lists"])
1690 other_user = insert(:user)
1691 assert {:ok, %Pleroma.List{id: _list_id} = list} = Pleroma.List.create("Test List", user)
1692 {:ok, %{following: _following}} = Pleroma.List.follow(list, other_user)
1694 assert [%{"id" => _list_id, "title" => "Test List"}] =
1696 |> get("/api/v1/accounts/#{other_user.id}/lists")
1697 |> json_response_and_validate_schema(200)
1701 describe "verify_credentials" do
1702 test "verify_credentials" do
1703 %{user: user, conn: conn} = oauth_access(["read:accounts"])
1705 [notification | _] =
1706 insert_list(7, :notification, user: user, activity: insert(:note_activity))
1708 Pleroma.Notification.set_read_up_to(user, notification.id)
1709 conn = get(conn, "/api/v1/accounts/verify_credentials")
1711 response = json_response_and_validate_schema(conn, 200)
1713 assert %{"id" => id, "source" => %{"privacy" => "public"}} = response
1714 assert response["pleroma"]["unread_notifications_count"] == 6
1715 assert id == to_string(user.id)
1718 test "verify_credentials default scope unlisted" do
1719 user = insert(:user, default_scope: "unlisted")
1720 %{conn: conn} = oauth_access(["read:accounts"], user: user)
1722 conn = get(conn, "/api/v1/accounts/verify_credentials")
1724 assert %{"id" => id, "source" => %{"privacy" => "unlisted"}} =
1725 json_response_and_validate_schema(conn, 200)
1727 assert id == to_string(user.id)
1730 test "locked accounts" do
1731 user = insert(:user, default_scope: "private")
1732 %{conn: conn} = oauth_access(["read:accounts"], user: user)
1734 conn = get(conn, "/api/v1/accounts/verify_credentials")
1736 assert %{"id" => id, "source" => %{"privacy" => "private"}} =
1737 json_response_and_validate_schema(conn, 200)
1739 assert id == to_string(user.id)
1743 describe "user relationships" do
1744 setup do: oauth_access(["read:follows"])
1746 test "returns the relationships for the current user", %{user: user, conn: conn} do
1747 %{id: other_user_id} = other_user = insert(:user)
1748 {:ok, _user, _other_user} = User.follow(user, other_user)
1750 assert [%{"id" => ^other_user_id}] =
1752 |> get("/api/v1/accounts/relationships?id=#{other_user.id}")
1753 |> json_response_and_validate_schema(200)
1755 assert [%{"id" => ^other_user_id}] =
1757 |> get("/api/v1/accounts/relationships?id[]=#{other_user.id}")
1758 |> json_response_and_validate_schema(200)
1761 test "returns an empty list on a bad request", %{conn: conn} do
1762 conn = get(conn, "/api/v1/accounts/relationships", %{})
1764 assert [] = json_response_and_validate_schema(conn, 200)
1768 test "getting a list of mutes" do
1769 %{user: user, conn: conn} = oauth_access(["read:mutes"])
1770 %{id: id1} = other_user1 = insert(:user)
1771 %{id: id2} = other_user2 = insert(:user)
1772 %{id: id3} = other_user3 = insert(:user)
1774 {:ok, _user_relationships} = User.mute(user, other_user1)
1775 {:ok, _user_relationships} = User.mute(user, other_user2)
1776 {:ok, _user_relationships} = User.mute(user, other_user3)
1780 |> get("/api/v1/mutes")
1781 |> json_response_and_validate_schema(200)
1783 assert [id1, id2, id3] == Enum.map(result, & &1["id"])
1787 |> get("/api/v1/mutes?limit=1")
1788 |> json_response_and_validate_schema(200)
1790 assert [%{"id" => ^id1}] = result
1794 |> get("/api/v1/mutes?since_id=#{id1}")
1795 |> json_response_and_validate_schema(200)
1797 assert [%{"id" => ^id2}, %{"id" => ^id3}] = result
1801 |> get("/api/v1/mutes?since_id=#{id1}&max_id=#{id3}")
1802 |> json_response_and_validate_schema(200)
1804 assert [%{"id" => ^id2}] = result
1808 |> get("/api/v1/mutes?since_id=#{id1}&limit=1")
1809 |> json_response_and_validate_schema(200)
1811 assert [%{"id" => ^id2}] = result
1814 test "list of mutes with with_relationships parameter" do
1815 %{user: user, conn: conn} = oauth_access(["read:mutes"])
1816 %{id: id1} = other_user1 = insert(:user)
1817 %{id: id2} = other_user2 = insert(:user)
1818 %{id: id3} = other_user3 = insert(:user)
1820 {:ok, _, _} = User.follow(other_user1, user)
1821 {:ok, _, _} = User.follow(other_user2, user)
1822 {:ok, _, _} = User.follow(other_user3, user)
1824 {:ok, _} = User.mute(user, other_user1)
1825 {:ok, _} = User.mute(user, other_user2)
1826 {:ok, _} = User.mute(user, other_user3)
1831 "pleroma" => %{"relationship" => %{"muting" => true, "followed_by" => true}}
1835 "pleroma" => %{"relationship" => %{"muting" => true, "followed_by" => true}}
1839 "pleroma" => %{"relationship" => %{"muting" => true, "followed_by" => true}}
1843 |> get("/api/v1/mutes?with_relationships=true")
1844 |> json_response_and_validate_schema(200)
1847 test "getting a list of blocks" do
1848 %{user: user, conn: conn} = oauth_access(["read:blocks"])
1849 %{id: id1} = other_user1 = insert(:user)
1850 %{id: id2} = other_user2 = insert(:user)
1851 %{id: id3} = other_user3 = insert(:user)
1853 {:ok, _user_relationship} = User.block(user, other_user1)
1854 {:ok, _user_relationship} = User.block(user, other_user3)
1855 {:ok, _user_relationship} = User.block(user, other_user2)
1859 |> assign(:user, user)
1860 |> get("/api/v1/blocks")
1861 |> json_response_and_validate_schema(200)
1863 assert [id1, id2, id3] == Enum.map(result, & &1["id"])
1867 |> assign(:user, user)
1868 |> get("/api/v1/blocks?limit=1")
1869 |> json_response_and_validate_schema(200)
1871 assert [%{"id" => ^id1}] = result
1875 |> assign(:user, user)
1876 |> get("/api/v1/blocks?since_id=#{id1}")
1877 |> json_response_and_validate_schema(200)
1879 assert [%{"id" => ^id2}, %{"id" => ^id3}] = result
1883 |> assign(:user, user)
1884 |> get("/api/v1/blocks?since_id=#{id1}&max_id=#{id3}")
1885 |> json_response_and_validate_schema(200)
1887 assert [%{"id" => ^id2}] = result
1891 |> assign(:user, user)
1892 |> get("/api/v1/blocks?since_id=#{id1}&limit=1")
1893 |> json_response_and_validate_schema(200)
1895 assert [%{"id" => ^id2}] = result
1898 test "account lookup", %{conn: conn} do
1899 %{nickname: acct} = insert(:user, %{nickname: "nickname"})
1900 %{nickname: acct_two} = insert(:user, %{nickname: "nickname@notlocaldoma.in"})
1904 |> get("/api/v1/accounts/lookup?acct=#{acct}")
1905 |> json_response_and_validate_schema(200)
1907 assert %{"acct" => ^acct} = result
1911 |> get("/api/v1/accounts/lookup?acct=#{acct_two}")
1912 |> json_response_and_validate_schema(200)
1914 assert %{"acct" => ^acct_two} = result
1918 |> get("/api/v1/accounts/lookup?acct=unexisting_nickname")
1919 |> json_response_and_validate_schema(404)
1922 test "account lookup with restrict unauthenticated profiles for local" do
1923 clear_config([:restrict_unauthenticated, :profiles, :local], true)
1925 user = insert(:user, local: true)
1926 reading_user = insert(:user)
1930 |> get("/api/v1/accounts/lookup?acct=#{user.nickname}")
1932 assert json_response_and_validate_schema(conn, 401)
1936 |> assign(:user, reading_user)
1937 |> assign(:token, insert(:oauth_token, user: reading_user, scopes: ["read:accounts"]))
1938 |> get("/api/v1/accounts/lookup?acct=#{user.nickname}")
1940 assert %{"id" => id} = json_response_and_validate_schema(conn, 200)
1941 assert id == user.id
1944 test "account lookup with restrict unauthenticated profiles for remote" do
1945 clear_config([:restrict_unauthenticated, :profiles, :remote], true)
1947 user = insert(:user, nickname: "user@example.com", local: false)
1948 reading_user = insert(:user)
1952 |> get("/api/v1/accounts/lookup?acct=#{user.nickname}")
1954 assert json_response_and_validate_schema(conn, 401)
1958 |> assign(:user, reading_user)
1959 |> assign(:token, insert(:oauth_token, user: reading_user, scopes: ["read:accounts"]))
1960 |> get("/api/v1/accounts/lookup?acct=#{user.nickname}")
1962 assert %{"id" => id} = json_response_and_validate_schema(conn, 200)
1963 assert id == user.id
1966 test "create a note on a user" do
1967 %{conn: conn} = oauth_access(["write:accounts", "read:follows"])
1968 other_user = insert(:user)
1971 |> put_req_header("content-type", "application/json")
1972 |> post("/api/v1/accounts/#{other_user.id}/note", %{
1973 "comment" => "Example note"
1976 assert [%{"note" => "Example note"}] =
1978 |> put_req_header("content-type", "application/json")
1979 |> get("/api/v1/accounts/relationships?id=#{other_user.id}")
1980 |> json_response_and_validate_schema(200)
1983 describe "remove from followers" do
1984 setup do: oauth_access(["follow"])
1986 test "removing user from followers", %{conn: conn, user: user} do
1987 %{id: other_user_id} = other_user = insert(:user)
1989 CommonAPI.follow(other_user, user)
1991 assert %{"id" => ^other_user_id, "followed_by" => false} =
1993 |> post("/api/v1/accounts/#{other_user_id}/remove_from_followers")
1994 |> json_response_and_validate_schema(200)
1996 refute User.following?(other_user, user)
1999 test "removing remote user from followers", %{conn: conn, user: user} do
2000 %{id: other_user_id} = other_user = insert(:user, local: false)
2002 CommonAPI.follow(other_user, user)
2004 assert User.following?(other_user, user)
2006 assert %{"id" => ^other_user_id, "followed_by" => false} =
2008 |> post("/api/v1/accounts/#{other_user_id}/remove_from_followers")
2009 |> json_response_and_validate_schema(200)
2011 refute User.following?(other_user, user)
2014 test "removing user from followers errors", %{user: user, conn: conn} do
2016 conn_res = post(conn, "/api/v1/accounts/#{user.id}/remove_from_followers")
2018 assert %{"error" => "Can not unfollow yourself"} =
2019 json_response_and_validate_schema(conn_res, 400)
2021 # remove non existing user
2022 conn_res = post(conn, "/api/v1/accounts/doesntexist/remove_from_followers")
2023 assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)