1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Web.TwitterAPI.RemoteFollowControllerTest do
6 use Pleroma.Web.ConnCase
11 alias Pleroma.Web.CommonAPI
13 import ExUnit.CaptureLog
14 import Pleroma.Factory
18 Tesla.Mock.mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
22 setup_all do: clear_config([:instance, :federating], true)
23 setup do: clear_config([:instance])
24 setup do: clear_config([:frontend_configurations, :pleroma_fe])
25 setup do: clear_config([:user, :deny_follow_blocked])
27 describe "GET /ostatus_subscribe - remote_follow/2" do
28 test "adds status to pleroma instance if the `acct` is a status", %{conn: conn} do
31 remote_follow_path(conn, :follow, %{
32 acct: "https://mastodon.social/users/emelie/statuses/101849165031453009"
35 |> redirected_to() =~ "/notice/"
38 test "show follow account page if the `acct` is a account link", %{conn: conn} do
41 |> get(remote_follow_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"}))
44 assert response =~ "Log in to follow"
47 test "show follow page if the `acct` is a account link", %{conn: conn} do
52 |> assign(:user, user)
53 |> get(remote_follow_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"}))
56 assert response =~ "Remote follow"
59 test "show follow page with error when user cannot fecth by `acct` link", %{conn: conn} do
62 assert capture_log(fn ->
65 |> assign(:user, user)
67 remote_follow_path(conn, :follow, %{
68 acct: "https://mastodon.social/users/not_found"
73 assert response =~ "Error fetching user"
74 end) =~ "Object has been deleted"
78 describe "POST /ostatus_subscribe - do_follow/2 with assigned user " do
79 test "required `follow | write:follows` scope", %{conn: conn} do
82 read_token = insert(:oauth_token, user: user, scopes: ["read"])
84 assert capture_log(fn ->
87 |> assign(:user, user)
88 |> assign(:token, read_token)
89 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
92 assert response =~ "Error following account"
93 end) =~ "Insufficient permissions: follow | write:follows."
96 test "follows user", %{conn: conn} do
102 |> assign(:user, user)
103 |> assign(:token, insert(:oauth_token, user: user, scopes: ["write:follows"]))
104 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
106 assert redirected_to(conn) == "/users/#{user2.id}"
109 test "returns error when user is deactivated", %{conn: conn} do
110 user = insert(:user, deactivated: true)
111 user2 = insert(:user)
115 |> assign(:user, user)
116 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
119 assert response =~ "Error following account"
122 test "returns error when user is blocked", %{conn: conn} do
123 Pleroma.Config.put([:user, :deny_follow_blocked], true)
125 user2 = insert(:user)
127 {:ok, _user_block} = Pleroma.User.block(user2, user)
131 |> assign(:user, user)
132 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
135 assert response =~ "Error following account"
138 test "returns error when followee not found", %{conn: conn} do
143 |> assign(:user, user)
144 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => "jimm"}})
147 assert response =~ "Error following account"
150 test "returns success result when user already in followers", %{conn: conn} do
152 user2 = insert(:user)
153 {:ok, _, _, _} = CommonAPI.follow(user, user2)
157 |> assign(:user, refresh_record(user))
158 |> assign(:token, insert(:oauth_token, user: user, scopes: ["write:follows"]))
159 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
161 assert redirected_to(conn) == "/users/#{user2.id}"
165 describe "POST /ostatus_subscribe - follow/2 with enabled Two-Factor Auth " do
166 test "render the MFA login form", %{conn: conn} do
167 otp_secret = TOTP.generate_secret()
171 multi_factor_authentication_settings: %MFA.Settings{
173 totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
177 user2 = insert(:user)
181 |> post(remote_follow_path(conn, :do_follow), %{
182 "authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
186 mfa_token = Pleroma.Repo.one(from(q in Pleroma.MFA.Token, where: q.user_id == ^user.id))
188 assert response =~ "Two-factor authentication"
189 assert response =~ "Authentication code"
190 assert response =~ mfa_token.token
191 refute user2.follower_address in User.following(user)
194 test "returns error when password is incorrect", %{conn: conn} do
195 otp_secret = TOTP.generate_secret()
199 multi_factor_authentication_settings: %MFA.Settings{
201 totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
205 user2 = insert(:user)
209 |> post(remote_follow_path(conn, :do_follow), %{
210 "authorization" => %{"name" => user.nickname, "password" => "test1", "id" => user2.id}
214 assert response =~ "Wrong username or password"
215 refute user2.follower_address in User.following(user)
218 test "follows", %{conn: conn} do
219 otp_secret = TOTP.generate_secret()
223 multi_factor_authentication_settings: %MFA.Settings{
225 totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
229 {:ok, %{token: token}} = MFA.Token.create(user)
231 user2 = insert(:user)
232 otp_token = TOTP.generate_token(otp_secret)
237 remote_follow_path(conn, :do_follow),
239 "mfa" => %{"code" => otp_token, "token" => token, "id" => user2.id}
243 assert redirected_to(conn) == "/users/#{user2.id}"
244 assert user2.follower_address in User.following(user)
247 test "returns error when auth code is incorrect", %{conn: conn} do
248 otp_secret = TOTP.generate_secret()
252 multi_factor_authentication_settings: %MFA.Settings{
254 totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
258 {:ok, %{token: token}} = MFA.Token.create(user)
260 user2 = insert(:user)
261 otp_token = TOTP.generate_token(TOTP.generate_secret())
266 remote_follow_path(conn, :do_follow),
268 "mfa" => %{"code" => otp_token, "token" => token, "id" => user2.id}
273 assert response =~ "Wrong authentication code"
274 refute user2.follower_address in User.following(user)
278 describe "POST /ostatus_subscribe - follow/2 without assigned user " do
279 test "follows", %{conn: conn} do
281 user2 = insert(:user)
285 |> post(remote_follow_path(conn, :do_follow), %{
286 "authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
289 assert redirected_to(conn) == "/users/#{user2.id}"
290 assert user2.follower_address in User.following(user)
293 test "returns error when followee not found", %{conn: conn} do
298 |> post(remote_follow_path(conn, :do_follow), %{
299 "authorization" => %{"name" => user.nickname, "password" => "test", "id" => "jimm"}
303 assert response =~ "Error following account"
306 test "returns error when login invalid", %{conn: conn} do
311 |> post(remote_follow_path(conn, :do_follow), %{
312 "authorization" => %{"name" => "jimm", "password" => "test", "id" => user.id}
316 assert response =~ "Wrong username or password"
319 test "returns error when password invalid", %{conn: conn} do
321 user2 = insert(:user)
325 |> post(remote_follow_path(conn, :do_follow), %{
326 "authorization" => %{"name" => user.nickname, "password" => "42", "id" => user2.id}
330 assert response =~ "Wrong username or password"
333 test "returns error when user is blocked", %{conn: conn} do
334 Pleroma.Config.put([:user, :deny_follow_blocked], true)
336 user2 = insert(:user)
337 {:ok, _user_block} = Pleroma.User.block(user2, user)
341 |> post(remote_follow_path(conn, :do_follow), %{
342 "authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
346 assert response =~ "Error following account"