1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Web.TwitterAPI.RemoteFollowControllerTest do
6 use Pleroma.Web.ConnCase
11 alias Pleroma.Web.CommonAPI
13 import ExUnit.CaptureLog
14 import Pleroma.Factory
17 setup_all do: clear_config([:instance, :federating], true)
18 setup do: clear_config([:user, :deny_follow_blocked])
20 describe "GET /ostatus_subscribe - remote_follow/2" do
21 test "adds status to pleroma instance if the `acct` is a status", %{conn: conn} do
23 %{method: :get, url: "https://mastodon.social/users/emelie/statuses/101849165031453009"} ->
26 headers: [{"content-type", "application/activity+json"}],
27 body: File.read!("test/fixtures/tesla_mock/status.emelie.json")
30 %{method: :get, url: "https://mastodon.social/users/emelie"} ->
33 headers: [{"content-type", "application/activity+json"}],
34 body: File.read!("test/fixtures/tesla_mock/emelie.json")
40 remote_follow_path(conn, :follow, %{
41 acct: "https://mastodon.social/users/emelie/statuses/101849165031453009"
44 |> redirected_to() =~ "/notice/"
47 test "show follow account page if the `acct` is a account link", %{conn: conn} do
49 %{method: :get, url: "https://mastodon.social/users/emelie"} ->
52 headers: [{"content-type", "application/activity+json"}],
53 body: File.read!("test/fixtures/tesla_mock/emelie.json")
59 |> get(remote_follow_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"}))
62 assert response =~ "Log in to follow"
65 test "show follow page if the `acct` is a account link", %{conn: conn} do
67 %{method: :get, url: "https://mastodon.social/users/emelie"} ->
70 headers: [{"content-type", "application/activity+json"}],
71 body: File.read!("test/fixtures/tesla_mock/emelie.json")
79 |> assign(:user, user)
80 |> get(remote_follow_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"}))
83 assert response =~ "Remote follow"
86 test "show follow page with error when user can not be fetched by `acct` link", %{conn: conn} do
88 %{method: :get, url: "https://mastodon.social/users/not_found"} ->
96 assert capture_log(fn ->
99 |> assign(:user, user)
101 remote_follow_path(conn, :follow, %{
102 acct: "https://mastodon.social/users/not_found"
105 |> html_response(200)
107 assert response =~ "Error fetching user"
108 end) =~ "Object has been deleted"
112 describe "POST /ostatus_subscribe - do_follow/2 with assigned user " do
113 test "required `follow | write:follows` scope", %{conn: conn} do
115 user2 = insert(:user)
116 read_token = insert(:oauth_token, user: user, scopes: ["read"])
118 assert capture_log(fn ->
121 |> assign(:user, user)
122 |> assign(:token, read_token)
123 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
126 assert response =~ "Error following account"
127 end) =~ "Insufficient permissions: follow | write:follows."
130 test "follows user", %{conn: conn} do
132 user2 = insert(:user)
136 |> assign(:user, user)
137 |> assign(:token, insert(:oauth_token, user: user, scopes: ["write:follows"]))
138 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
140 assert redirected_to(conn) == "/users/#{user2.id}"
143 test "returns error when user is deactivated", %{conn: conn} do
144 user = insert(:user, is_active: false)
145 user2 = insert(:user)
149 |> assign(:user, user)
150 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
153 assert response =~ "Error following account"
156 test "returns error when user is blocked", %{conn: conn} do
157 clear_config([:user, :deny_follow_blocked], true)
159 user2 = insert(:user)
161 {:ok, _user_block} = Pleroma.User.block(user2, user)
165 |> assign(:user, user)
166 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
169 assert response =~ "Error following account"
172 test "returns error when followee not found", %{conn: conn} do
177 |> assign(:user, user)
178 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => "jimm"}})
181 assert response =~ "Error following account"
184 test "returns success result when user already in followers", %{conn: conn} do
186 user2 = insert(:user)
187 {:ok, _, _, _} = CommonAPI.follow(user, user2)
191 |> assign(:user, refresh_record(user))
192 |> assign(:token, insert(:oauth_token, user: user, scopes: ["write:follows"]))
193 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
195 assert redirected_to(conn) == "/users/#{user2.id}"
199 describe "POST /ostatus_subscribe - follow/2 with enabled Two-Factor Auth " do
200 test "render the MFA login form", %{conn: conn} do
201 otp_secret = TOTP.generate_secret()
205 multi_factor_authentication_settings: %MFA.Settings{
207 totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
211 user2 = insert(:user)
215 |> post(remote_follow_path(conn, :do_follow), %{
216 "authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
220 mfa_token = Pleroma.Repo.one(from(q in Pleroma.MFA.Token, where: q.user_id == ^user.id))
222 assert response =~ "Two-factor authentication"
223 assert response =~ "Authentication code"
224 assert response =~ mfa_token.token
225 refute user2.follower_address in User.following(user)
228 test "returns error when password is incorrect", %{conn: conn} do
229 otp_secret = TOTP.generate_secret()
233 multi_factor_authentication_settings: %MFA.Settings{
235 totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
239 user2 = insert(:user)
243 |> post(remote_follow_path(conn, :do_follow), %{
244 "authorization" => %{"name" => user.nickname, "password" => "test1", "id" => user2.id}
248 assert response =~ "Wrong username or password"
249 refute user2.follower_address in User.following(user)
252 test "follows", %{conn: conn} do
253 otp_secret = TOTP.generate_secret()
257 multi_factor_authentication_settings: %MFA.Settings{
259 totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
263 {:ok, %{token: token}} = MFA.Token.create(user)
265 user2 = insert(:user)
266 otp_token = TOTP.generate_token(otp_secret)
271 remote_follow_path(conn, :do_follow),
273 "mfa" => %{"code" => otp_token, "token" => token, "id" => user2.id}
277 assert redirected_to(conn) == "/users/#{user2.id}"
278 assert user2.follower_address in User.following(user)
281 test "returns error when auth code is incorrect", %{conn: conn} do
282 otp_secret = TOTP.generate_secret()
286 multi_factor_authentication_settings: %MFA.Settings{
288 totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
292 {:ok, %{token: token}} = MFA.Token.create(user)
294 user2 = insert(:user)
295 otp_token = TOTP.generate_token(TOTP.generate_secret())
300 remote_follow_path(conn, :do_follow),
302 "mfa" => %{"code" => otp_token, "token" => token, "id" => user2.id}
307 assert response =~ "Wrong authentication code"
308 refute user2.follower_address in User.following(user)
312 describe "POST /ostatus_subscribe - follow/2 without assigned user " do
313 test "follows", %{conn: conn} do
315 user2 = insert(:user)
319 |> post(remote_follow_path(conn, :do_follow), %{
320 "authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
323 assert redirected_to(conn) == "/users/#{user2.id}"
324 assert user2.follower_address in User.following(user)
327 test "returns error when followee not found", %{conn: conn} do
332 |> post(remote_follow_path(conn, :do_follow), %{
333 "authorization" => %{"name" => user.nickname, "password" => "test", "id" => "jimm"}
337 assert response =~ "Error following account"
340 test "returns error when login invalid", %{conn: conn} do
345 |> post(remote_follow_path(conn, :do_follow), %{
346 "authorization" => %{"name" => "jimm", "password" => "test", "id" => user.id}
350 assert response =~ "Wrong username or password"
353 test "returns error when password invalid", %{conn: conn} do
355 user2 = insert(:user)
359 |> post(remote_follow_path(conn, :do_follow), %{
360 "authorization" => %{"name" => user.nickname, "password" => "42", "id" => user2.id}
364 assert response =~ "Wrong username or password"
367 test "returns error when user is blocked", %{conn: conn} do
368 clear_config([:user, :deny_follow_blocked], true)
370 user2 = insert(:user)
371 {:ok, _user_block} = Pleroma.User.block(user2, user)
375 |> post(remote_follow_path(conn, :do_follow), %{
376 "authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
380 assert response =~ "Error following account"