1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Web.TwitterAPI.RemoteFollowControllerTest do
6 use Pleroma.Web.ConnCase
11 alias Pleroma.Web.CommonAPI
13 import ExUnit.CaptureLog
14 import Pleroma.Factory
17 setup_all do: clear_config([:instance, :federating], true)
18 setup do: clear_config([:user, :deny_follow_blocked])
20 describe "GET /ostatus_subscribe - remote_follow/2" do
21 test "adds status to pleroma instance if the `acct` is a status", %{conn: conn} do
23 %{method: :get, url: "https://mastodon.social/users/emelie/statuses/101849165031453009"} ->
26 headers: [{"content-type", "application/activity+json"}],
27 body: File.read!("test/fixtures/tesla_mock/status.emelie.json")
30 %{method: :get, url: "https://mastodon.social/users/emelie/collections/featured"} ->
33 headers: [{"content-type", "application/activity+json"}],
35 File.read!("test/fixtures/users_mock/masto_featured.json")
36 |> String.replace("{{domain}}", "mastodon.social")
37 |> String.replace("{{nickname}}", "emelie")
40 %{method: :get, url: "https://mastodon.social/users/emelie"} ->
43 headers: [{"content-type", "application/activity+json"}],
44 body: File.read!("test/fixtures/tesla_mock/emelie.json")
50 remote_follow_path(conn, :follow, %{
51 acct: "https://mastodon.social/users/emelie/statuses/101849165031453009"
54 |> redirected_to() =~ "/notice/"
57 test "show follow account page if the `acct` is a account link", %{conn: conn} do
59 %{method: :get, url: "https://mastodon.social/users/emelie"} ->
62 headers: [{"content-type", "application/activity+json"}],
63 body: File.read!("test/fixtures/tesla_mock/emelie.json")
66 %{method: :get, url: "https://mastodon.social/users/emelie/collections/featured"} ->
69 headers: [{"content-type", "application/activity+json"}],
71 File.read!("test/fixtures/users_mock/masto_featured.json")
72 |> String.replace("{{domain}}", "mastodon.social")
73 |> String.replace("{{nickname}}", "emelie")
79 |> get(remote_follow_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"}))
82 assert response =~ "Log in to follow"
85 test "show follow page if the `acct` is a account link", %{conn: conn} do
87 %{method: :get, url: "https://mastodon.social/users/emelie"} ->
90 headers: [{"content-type", "application/activity+json"}],
91 body: File.read!("test/fixtures/tesla_mock/emelie.json")
94 %{method: :get, url: "https://mastodon.social/users/emelie/collections/featured"} ->
97 headers: [{"content-type", "application/activity+json"}],
99 File.read!("test/fixtures/users_mock/masto_featured.json")
100 |> String.replace("{{domain}}", "mastodon.social")
101 |> String.replace("{{nickname}}", "emelie")
109 |> assign(:user, user)
110 |> get(remote_follow_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"}))
111 |> html_response(200)
113 assert response =~ "Remote follow"
116 test "show follow page with error when user can not be fetched by `acct` link", %{conn: conn} do
118 %{method: :get, url: "https://mastodon.social/users/not_found"} ->
126 assert capture_log(fn ->
129 |> assign(:user, user)
131 remote_follow_path(conn, :follow, %{
132 acct: "https://mastodon.social/users/not_found"
135 |> html_response(200)
137 assert response =~ "Error fetching user"
138 end) =~ "Object has been deleted"
142 describe "POST /ostatus_subscribe - do_follow/2 with assigned user " do
143 test "required `follow | write:follows` scope", %{conn: conn} do
145 user2 = insert(:user)
146 read_token = insert(:oauth_token, user: user, scopes: ["read"])
148 assert capture_log(fn ->
151 |> assign(:user, user)
152 |> assign(:token, read_token)
153 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
156 assert response =~ "Error following account"
157 end) =~ "Insufficient permissions: follow | write:follows."
160 test "follows user", %{conn: conn} do
162 user2 = insert(:user)
166 |> assign(:user, user)
167 |> assign(:token, insert(:oauth_token, user: user, scopes: ["write:follows"]))
168 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
170 assert redirected_to(conn) == "/users/#{user2.id}"
173 test "returns error when user is deactivated", %{conn: conn} do
174 user = insert(:user, is_active: false)
175 user2 = insert(:user)
179 |> assign(:user, user)
180 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
183 assert response =~ "Error following account"
186 test "returns error when user is blocked", %{conn: conn} do
187 clear_config([:user, :deny_follow_blocked], true)
189 user2 = insert(:user)
191 {:ok, _user_block} = Pleroma.User.block(user2, user)
195 |> assign(:user, user)
196 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
199 assert response =~ "Error following account"
202 test "returns error when followee not found", %{conn: conn} do
207 |> assign(:user, user)
208 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => "jimm"}})
211 assert response =~ "Error following account"
214 test "returns success result when user already in followers", %{conn: conn} do
216 user2 = insert(:user)
217 {:ok, _, _, _} = CommonAPI.follow(user, user2)
221 |> assign(:user, refresh_record(user))
222 |> assign(:token, insert(:oauth_token, user: user, scopes: ["write:follows"]))
223 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
225 assert redirected_to(conn) == "/users/#{user2.id}"
229 describe "POST /ostatus_subscribe - follow/2 with enabled Two-Factor Auth " do
230 test "render the MFA login form", %{conn: conn} do
231 otp_secret = TOTP.generate_secret()
235 multi_factor_authentication_settings: %MFA.Settings{
237 totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
241 user2 = insert(:user)
245 |> post(remote_follow_path(conn, :do_follow), %{
246 "authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
250 mfa_token = Pleroma.Repo.one(from(q in Pleroma.MFA.Token, where: q.user_id == ^user.id))
252 assert response =~ "Two-factor authentication"
253 assert response =~ "Authentication code"
254 assert response =~ mfa_token.token
255 refute user2.follower_address in User.following(user)
258 test "returns error when password is incorrect", %{conn: conn} do
259 otp_secret = TOTP.generate_secret()
263 multi_factor_authentication_settings: %MFA.Settings{
265 totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
269 user2 = insert(:user)
273 |> post(remote_follow_path(conn, :do_follow), %{
274 "authorization" => %{"name" => user.nickname, "password" => "test1", "id" => user2.id}
278 assert response =~ "Wrong username or password"
279 refute user2.follower_address in User.following(user)
282 test "follows", %{conn: conn} do
283 otp_secret = TOTP.generate_secret()
287 multi_factor_authentication_settings: %MFA.Settings{
289 totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
293 {:ok, %{token: token}} = MFA.Token.create(user)
295 user2 = insert(:user)
296 otp_token = TOTP.generate_token(otp_secret)
301 remote_follow_path(conn, :do_follow),
303 "mfa" => %{"code" => otp_token, "token" => token, "id" => user2.id}
307 assert redirected_to(conn) == "/users/#{user2.id}"
308 assert user2.follower_address in User.following(user)
311 test "returns error when auth code is incorrect", %{conn: conn} do
312 otp_secret = TOTP.generate_secret()
316 multi_factor_authentication_settings: %MFA.Settings{
318 totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
322 {:ok, %{token: token}} = MFA.Token.create(user)
324 user2 = insert(:user)
325 otp_token = TOTP.generate_token(TOTP.generate_secret())
330 remote_follow_path(conn, :do_follow),
332 "mfa" => %{"code" => otp_token, "token" => token, "id" => user2.id}
337 assert response =~ "Wrong authentication code"
338 refute user2.follower_address in User.following(user)
342 describe "POST /ostatus_subscribe - follow/2 without assigned user " do
343 test "follows", %{conn: conn} do
345 user2 = insert(:user)
349 |> post(remote_follow_path(conn, :do_follow), %{
350 "authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
353 assert redirected_to(conn) == "/users/#{user2.id}"
354 assert user2.follower_address in User.following(user)
357 test "returns error when followee not found", %{conn: conn} do
362 |> post(remote_follow_path(conn, :do_follow), %{
363 "authorization" => %{"name" => user.nickname, "password" => "test", "id" => "jimm"}
367 assert response =~ "Error following account"
370 test "returns error when login invalid", %{conn: conn} do
375 |> post(remote_follow_path(conn, :do_follow), %{
376 "authorization" => %{"name" => "jimm", "password" => "test", "id" => user.id}
380 assert response =~ "Wrong username or password"
383 test "returns error when password invalid", %{conn: conn} do
385 user2 = insert(:user)
389 |> post(remote_follow_path(conn, :do_follow), %{
390 "authorization" => %{"name" => user.nickname, "password" => "42", "id" => user2.id}
394 assert response =~ "Wrong username or password"
397 test "returns error when user is blocked", %{conn: conn} do
398 clear_config([:user, :deny_follow_blocked], true)
400 user2 = insert(:user)
401 {:ok, _user_block} = Pleroma.User.block(user2, user)
405 |> post(remote_follow_path(conn, :do_follow), %{
406 "authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
410 assert response =~ "Error following account"