git.squeep.com Git - akkoma/blob - test/pleroma/web/mastodon_api/controllers/timeline_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.TimelineControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   import Pleroma.Factory
   9   import Tesla.Mock
  10
  11   alias Pleroma.User
  12   alias Pleroma.Web.CommonAPI
  13
  14   setup do
  15     mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
  16     :ok
  17   end
  18
  19   describe "home" do
  20     setup do: oauth_access(["read:statuses"])
  21
  22     test "does NOT embed account/pleroma/relationship in statuses", %{
  23       user: user,
  24       conn: conn
  25     } do
  26       other_user = insert(:user)
  27
  28       {:ok, _} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})
  29
  30       response =
  31         conn
  32         |> assign(:user, user)
  33         |> get("/api/v1/timelines/home")
  34         |> json_response_and_validate_schema(200)
  35
  36       assert Enum.all?(response, fn n ->
  37                get_in(n, ["account", "pleroma", "relationship"]) == %{}
  38              end)
  39     end
  40
  41     test "the home timeline when the direct messages are excluded", %{user: user, conn: conn} do
  42       {:ok, public_activity} = CommonAPI.post(user, %{status: ".", visibility: "public"})
  43       {:ok, direct_activity} = CommonAPI.post(user, %{status: ".", visibility: "direct"})
  44
  45       {:ok, unlisted_activity} = CommonAPI.post(user, %{status: ".", visibility: "unlisted"})
  46
  47       {:ok, private_activity} = CommonAPI.post(user, %{status: ".", visibility: "private"})
  48
  49       conn = get(conn, "/api/v1/timelines/home?exclude_visibilities[]=direct")
  50
  51       assert status_ids = json_response_and_validate_schema(conn, :ok) |> Enum.map(& &1["id"])
  52       assert public_activity.id in status_ids
  53       assert unlisted_activity.id in status_ids
  54       assert private_activity.id in status_ids
  55       refute direct_activity.id in status_ids
  56     end
  57   end
  58
  59   describe "public" do
  60     @tag capture_log: true
  61     test "the public timeline", %{conn: conn} do
  62       user = insert(:user)
  63
  64       {:ok, activity} = CommonAPI.post(user, %{status: "test"})
  65
  66       _activity = insert(:note_activity, local: false)
  67
  68       conn = get(conn, "/api/v1/timelines/public?local=False")
  69
  70       assert length(json_response_and_validate_schema(conn, :ok)) == 2
  71
  72       conn = get(build_conn(), "/api/v1/timelines/public?local=True")
  73
  74       assert [%{"content" => "test"}] = json_response_and_validate_schema(conn, :ok)
  75
  76       conn = get(build_conn(), "/api/v1/timelines/public?local=1")
  77
  78       assert [%{"content" => "test"}] = json_response_and_validate_schema(conn, :ok)
  79
  80       # does not contain repeats
  81       {:ok, _} = CommonAPI.repeat(activity.id, user)
  82
  83       conn = get(build_conn(), "/api/v1/timelines/public?local=true")
  84
  85       assert [_] = json_response_and_validate_schema(conn, :ok)
  86     end
  87
  88     test "the public timeline includes only public statuses for an authenticated user" do
  89       %{user: user, conn: conn} = oauth_access(["read:statuses"])
  90
  91       {:ok, _activity} = CommonAPI.post(user, %{status: "test"})
  92       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "private"})
  93       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "unlisted"})
  94       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "direct"})
  95
  96       res_conn = get(conn, "/api/v1/timelines/public")
  97       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
  98     end
  99
 100     test "doesn't return replies if follower is posting with blocked user" do
 101       %{conn: conn, user: blocker} = oauth_access(["read:statuses"])
 102       [blockee, friend] = insert_list(2, :user)
 103       {:ok, blocker} = User.follow(blocker, friend)
 104       {:ok, _} = User.block(blocker, blockee)
 105
 106       conn = assign(conn, :user, blocker)
 107
 108       {:ok, %{id: activity_id} = activity} = CommonAPI.post(friend, %{status: "hey!"})
 109
 110       {:ok, reply_from_blockee} =
 111         CommonAPI.post(blockee, %{status: "heya", in_reply_to_status_id: activity})
 112
 113       {:ok, _reply_from_friend} =
 114         CommonAPI.post(friend, %{status: "status", in_reply_to_status_id: reply_from_blockee})
 115
 116       # Still shows replies from yourself
 117       {:ok, %{id: reply_from_me}} =
 118         CommonAPI.post(blocker, %{status: "status", in_reply_to_status_id: reply_from_blockee})
 119
 120       response =
 121         get(conn, "/api/v1/timelines/public")
 122         |> json_response_and_validate_schema(200)
 123
 124       assert length(response) == 2
 125       [%{"id" => ^reply_from_me}, %{"id" => ^activity_id}] = response
 126     end
 127
 128     test "doesn't return replies if follow is posting with users from blocked domain" do
 129       %{conn: conn, user: blocker} = oauth_access(["read:statuses"])
 130       friend = insert(:user)
 131       blockee = insert(:user, ap_id: "https://example.com/users/blocked")
 132       {:ok, blocker} = User.follow(blocker, friend)
 133       {:ok, blocker} = User.block_domain(blocker, "example.com")
 134
 135       conn = assign(conn, :user, blocker)
 136
 137       {:ok, %{id: activity_id} = activity} = CommonAPI.post(friend, %{status: "hey!"})
 138
 139       {:ok, reply_from_blockee} =
 140         CommonAPI.post(blockee, %{status: "heya", in_reply_to_status_id: activity})
 141
 142       {:ok, _reply_from_friend} =
 143         CommonAPI.post(friend, %{status: "status", in_reply_to_status_id: reply_from_blockee})
 144
 145       res_conn = get(conn, "/api/v1/timelines/public")
 146
 147       activities = json_response_and_validate_schema(res_conn, 200)
 148       [%{"id" => ^activity_id}] = activities
 149     end
 150
 151     test "can be filtered by instance", %{conn: conn} do
 152       user = insert(:user, ap_id: "https://lain.com/users/lain")
 153       insert(:note_activity, local: false)
 154       insert(:note_activity, local: false)
 155
 156       {:ok, _} = CommonAPI.post(user, %{status: "test"})
 157
 158       conn = get(conn, "/api/v1/timelines/public?instance=lain.com")
 159
 160       assert length(json_response_and_validate_schema(conn, :ok)) == 1
 161     end
 162   end
 163
 164   defp local_and_remote_activities do
 165     insert(:note_activity)
 166     insert(:note_activity, local: false)
 167     :ok
 168   end
 169
 170   describe "public with restrict unauthenticated timeline for local and federated timelines" do
 171     setup do: local_and_remote_activities()
 172
 173     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 174
 175     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 176
 177     test "if user is unauthenticated", %{conn: conn} do
 178       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 179
 180       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 181                "error" => "authorization required for timeline view"
 182              }
 183
 184       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 185
 186       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 187                "error" => "authorization required for timeline view"
 188              }
 189     end
 190
 191     test "if user is authenticated" do
 192       %{conn: conn} = oauth_access(["read:statuses"])
 193
 194       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 195       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 196
 197       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 198       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 199     end
 200   end
 201
 202   describe "public with restrict unauthenticated timeline for local" do
 203     setup do: local_and_remote_activities()
 204
 205     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 206
 207     test "if user is unauthenticated", %{conn: conn} do
 208       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 209
 210       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 211                "error" => "authorization required for timeline view"
 212              }
 213
 214       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 215       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 216     end
 217
 218     test "if user is authenticated", %{conn: _conn} do
 219       %{conn: conn} = oauth_access(["read:statuses"])
 220
 221       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 222       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 223
 224       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 225       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 226     end
 227   end
 228
 229   describe "public with restrict unauthenticated timeline for remote" do
 230     setup do: local_and_remote_activities()
 231
 232     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 233
 234     test "if user is unauthenticated", %{conn: conn} do
 235       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 236       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 237
 238       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 239
 240       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 241                "error" => "authorization required for timeline view"
 242              }
 243     end
 244
 245     test "if user is authenticated", %{conn: _conn} do
 246       %{conn: conn} = oauth_access(["read:statuses"])
 247
 248       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 249       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 250
 251       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 252       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 253     end
 254   end
 255
 256   describe "direct" do
 257     test "direct timeline", %{conn: conn} do
 258       user_one = insert(:user)
 259       user_two = insert(:user)
 260
 261       {:ok, user_two} = User.follow(user_two, user_one)
 262
 263       {:ok, direct} =
 264         CommonAPI.post(user_one, %{
 265           status: "Hi @#{user_two.nickname}!",
 266           visibility: "direct"
 267         })
 268
 269       {:ok, _follower_only} =
 270         CommonAPI.post(user_one, %{
 271           status: "Hi @#{user_two.nickname}!",
 272           visibility: "private"
 273         })
 274
 275       conn_user_two =
 276         conn
 277         |> assign(:user, user_two)
 278         |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
 279
 280       # Only direct should be visible here
 281       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 282
 283       assert [status] = json_response_and_validate_schema(res_conn, :ok)
 284
 285       assert %{"visibility" => "direct"} = status
 286       assert status["url"] != direct.data["id"]
 287
 288       # User should be able to see their own direct message
 289       res_conn =
 290         build_conn()
 291         |> assign(:user, user_one)
 292         |> assign(:token, insert(:oauth_token, user: user_one, scopes: ["read:statuses"]))
 293         |> get("api/v1/timelines/direct")
 294
 295       [status] = json_response_and_validate_schema(res_conn, :ok)
 296
 297       assert %{"visibility" => "direct"} = status
 298
 299       # Both should be visible here
 300       res_conn = get(conn_user_two, "api/v1/timelines/home")
 301
 302       [_s1, _s2] = json_response_and_validate_schema(res_conn, :ok)
 303
 304       # Test pagination
 305       Enum.each(1..20, fn _ ->
 306         {:ok, _} =
 307           CommonAPI.post(user_one, %{
 308             status: "Hi @#{user_two.nickname}!",
 309             visibility: "direct"
 310           })
 311       end)
 312
 313       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 314
 315       statuses = json_response_and_validate_schema(res_conn, :ok)
 316       assert length(statuses) == 20
 317
 318       max_id = List.last(statuses)["id"]
 319
 320       res_conn = get(conn_user_two, "api/v1/timelines/direct?max_id=#{max_id}")
 321
 322       assert [status] = json_response_and_validate_schema(res_conn, :ok)
 323
 324       assert status["url"] != direct.data["id"]
 325     end
 326
 327     test "doesn't include DMs from blocked users" do
 328       %{user: blocker, conn: conn} = oauth_access(["read:statuses"])
 329       blocked = insert(:user)
 330       other_user = insert(:user)
 331       {:ok, _user_relationship} = User.block(blocker, blocked)
 332
 333       {:ok, _blocked_direct} =
 334         CommonAPI.post(blocked, %{
 335           status: "Hi @#{blocker.nickname}!",
 336           visibility: "direct"
 337         })
 338
 339       {:ok, direct} =
 340         CommonAPI.post(other_user, %{
 341           status: "Hi @#{blocker.nickname}!",
 342           visibility: "direct"
 343         })
 344
 345       res_conn = get(conn, "api/v1/timelines/direct")
 346
 347       [status] = json_response_and_validate_schema(res_conn, :ok)
 348       assert status["id"] == direct.id
 349     end
 350   end
 351
 352   describe "list" do
 353     setup do: oauth_access(["read:lists"])
 354
 355     test "does not contain retoots", %{user: user, conn: conn} do
 356       other_user = insert(:user)
 357       {:ok, activity_one} = CommonAPI.post(user, %{status: "Marisa is cute."})
 358       {:ok, activity_two} = CommonAPI.post(other_user, %{status: "Marisa is stupid."})
 359       {:ok, _} = CommonAPI.repeat(activity_one.id, other_user)
 360
 361       {:ok, list} = Pleroma.List.create("name", user)
 362       {:ok, list} = Pleroma.List.follow(list, other_user)
 363
 364       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 365
 366       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 367
 368       assert id == to_string(activity_two.id)
 369     end
 370
 371     test "works with pagination", %{user: user, conn: conn} do
 372       other_user = insert(:user)
 373       {:ok, list} = Pleroma.List.create("name", user)
 374       {:ok, list} = Pleroma.List.follow(list, other_user)
 375
 376       Enum.each(1..30, fn i ->
 377         CommonAPI.post(other_user, %{status: "post number #{i}"})
 378       end)
 379
 380       res =
 381         get(conn, "/api/v1/timelines/list/#{list.id}?limit=1")
 382         |> json_response_and_validate_schema(:ok)
 383
 384       assert length(res) == 1
 385
 386       [first] = res
 387
 388       res =
 389         get(conn, "/api/v1/timelines/list/#{list.id}?max_id=#{first["id"]}&limit=30")
 390         |> json_response_and_validate_schema(:ok)
 391
 392       assert length(res) == 29
 393     end
 394
 395     test "list timeline", %{user: user, conn: conn} do
 396       other_user = insert(:user)
 397       {:ok, _activity_one} = CommonAPI.post(user, %{status: "Marisa is cute."})
 398       {:ok, activity_two} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 399       {:ok, list} = Pleroma.List.create("name", user)
 400       {:ok, list} = Pleroma.List.follow(list, other_user)
 401
 402       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 403
 404       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 405
 406       assert id == to_string(activity_two.id)
 407     end
 408
 409     test "list timeline does not leak non-public statuses for unfollowed users", %{
 410       user: user,
 411       conn: conn
 412     } do
 413       other_user = insert(:user)
 414       {:ok, activity_one} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 415
 416       {:ok, _activity_two} =
 417         CommonAPI.post(other_user, %{
 418           status: "Marisa is cute.",
 419           visibility: "private"
 420         })
 421
 422       {:ok, list} = Pleroma.List.create("name", user)
 423       {:ok, list} = Pleroma.List.follow(list, other_user)
 424
 425       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 426
 427       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 428
 429       assert id == to_string(activity_one.id)
 430     end
 431   end
 432
 433   describe "hashtag" do
 434     setup do: oauth_access(["n/a"])
 435
 436     @tag capture_log: true
 437     test "hashtag timeline", %{conn: conn} do
 438       following = insert(:user)
 439
 440       {:ok, activity} = CommonAPI.post(following, %{status: "test #2hu"})
 441
 442       nconn = get(conn, "/api/v1/timelines/tag/2hu")
 443
 444       assert [%{"id" => id}] = json_response_and_validate_schema(nconn, :ok)
 445
 446       assert id == to_string(activity.id)
 447
 448       # works for different capitalization too
 449       nconn = get(conn, "/api/v1/timelines/tag/2HU")
 450
 451       assert [%{"id" => id}] = json_response_and_validate_schema(nconn, :ok)
 452
 453       assert id == to_string(activity.id)
 454     end
 455
 456     test "multi-hashtag timeline", %{conn: conn} do
 457       user = insert(:user)
 458
 459       {:ok, activity_test} = CommonAPI.post(user, %{status: "#test"})
 460       {:ok, activity_test1} = CommonAPI.post(user, %{status: "#test #test1"})
 461       {:ok, activity_none} = CommonAPI.post(user, %{status: "#test #none"})
 462
 463       any_test = get(conn, "/api/v1/timelines/tag/test?any[]=test1")
 464
 465       [status_none, status_test1, status_test] = json_response_and_validate_schema(any_test, :ok)
 466
 467       assert to_string(activity_test.id) == status_test["id"]
 468       assert to_string(activity_test1.id) == status_test1["id"]
 469       assert to_string(activity_none.id) == status_none["id"]
 470
 471       restricted_test = get(conn, "/api/v1/timelines/tag/test?all[]=test1&none[]=none")
 472
 473       assert [status_test1] == json_response_and_validate_schema(restricted_test, :ok)
 474
 475       all_test = get(conn, "/api/v1/timelines/tag/test?all[]=none")
 476
 477       assert [status_none] == json_response_and_validate_schema(all_test, :ok)
 478     end
 479   end
 480
 481   describe "hashtag timeline handling of :restrict_unauthenticated setting" do
 482     setup do
 483       user = insert(:user)
 484       {:ok, activity1} = CommonAPI.post(user, %{status: "test #tag1"})
 485       {:ok, _activity2} = CommonAPI.post(user, %{status: "test #tag1"})
 486
 487       activity1
 488       |> Ecto.Changeset.change(%{local: false})
 489       |> Pleroma.Repo.update()
 490
 491       base_uri = "/api/v1/timelines/tag/tag1"
 492       error_response = %{"error" => "authorization required for timeline view"}
 493
 494       %{base_uri: base_uri, error_response: error_response}
 495     end
 496
 497     defp ensure_authenticated_access(base_uri) do
 498       %{conn: auth_conn} = oauth_access(["read:statuses"])
 499
 500       res_conn = get(auth_conn, "#{base_uri}?local=true")
 501       assert length(json_response(res_conn, 200)) == 1
 502
 503       res_conn = get(auth_conn, "#{base_uri}?local=false")
 504       assert length(json_response(res_conn, 200)) == 2
 505     end
 506
 507     test "with default settings on private instances, returns 403 for unauthenticated users", %{
 508       conn: conn,
 509       base_uri: base_uri,
 510       error_response: error_response
 511     } do
 512       clear_config([:instance, :public], false)
 513       clear_config([:restrict_unauthenticated, :timelines])
 514
 515       for local <- [true, false] do
 516         res_conn = get(conn, "#{base_uri}?local=#{local}")
 517
 518         assert json_response(res_conn, :unauthorized) == error_response
 519       end
 520
 521       ensure_authenticated_access(base_uri)
 522     end
 523
 524     test "with `%{local: true, federated: true}`, returns 403 for unauthenticated users", %{
 525       conn: conn,
 526       base_uri: base_uri,
 527       error_response: error_response
 528     } do
 529       clear_config([:restrict_unauthenticated, :timelines, :local], true)
 530       clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 531
 532       for local <- [true, false] do
 533         res_conn = get(conn, "#{base_uri}?local=#{local}")
 534
 535         assert json_response(res_conn, :unauthorized) == error_response
 536       end
 537
 538       ensure_authenticated_access(base_uri)
 539     end
 540
 541     test "with `%{local: false, federated: true}`, forbids unauthenticated access to federated timeline",
 542          %{conn: conn, base_uri: base_uri, error_response: error_response} do
 543       clear_config([:restrict_unauthenticated, :timelines, :local], false)
 544       clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 545
 546       res_conn = get(conn, "#{base_uri}?local=true")
 547       assert length(json_response(res_conn, 200)) == 1
 548
 549       res_conn = get(conn, "#{base_uri}?local=false")
 550       assert json_response(res_conn, :unauthorized) == error_response
 551
 552       ensure_authenticated_access(base_uri)
 553     end
 554
 555     test "with `%{local: true, federated: false}`, forbids unauthenticated access to public timeline" <>
 556            "(but not to local public activities which are delivered as part of federated timeline)",
 557          %{conn: conn, base_uri: base_uri, error_response: error_response} do
 558       clear_config([:restrict_unauthenticated, :timelines, :local], true)
 559       clear_config([:restrict_unauthenticated, :timelines, :federated], false)
 560
 561       res_conn = get(conn, "#{base_uri}?local=true")
 562       assert json_response(res_conn, :unauthorized) == error_response
 563
 564       # Note: local activities get delivered as part of federated timeline
 565       res_conn = get(conn, "#{base_uri}?local=false")
 566       assert length(json_response(res_conn, 200)) == 2
 567
 568       ensure_authenticated_access(base_uri)
 569     end
 570   end
 571 end