git.squeep.com Git - akkoma/blob - test/web/activity_pub/activity_pub_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
   6   use Pleroma.Web.ConnCase
   7   use Oban.Testing, repo: Pleroma.Repo
   8
   9   import Pleroma.Factory
  10   alias Pleroma.Activity
  11   alias Pleroma.Config
  12   alias Pleroma.Delivery
  13   alias Pleroma.Instances
  14   alias Pleroma.Object
  15   alias Pleroma.Tests.ObanHelpers
  16   alias Pleroma.User
  17   alias Pleroma.Web.ActivityPub.ObjectView
  18   alias Pleroma.Web.ActivityPub.Relay
  19   alias Pleroma.Web.ActivityPub.UserView
  20   alias Pleroma.Web.ActivityPub.Utils
  21   alias Pleroma.Web.CommonAPI
  22   alias Pleroma.Workers.ReceiverWorker
  23
  24   setup_all do
  25     Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
  26     :ok
  27   end
  28
  29   setup do: clear_config([:instance, :federating], true)
  30
  31   describe "/relay" do
  32     setup do: clear_config([:instance, :allow_relay])
  33
  34     test "with the relay active, it returns the relay user", %{conn: conn} do
  35       res =
  36         conn
  37         |> get(activity_pub_path(conn, :relay))
  38         |> json_response(200)
  39
  40       assert res["id"] =~ "/relay"
  41     end
  42
  43     test "with the relay disabled, it returns 404", %{conn: conn} do
  44       Config.put([:instance, :allow_relay], false)
  45
  46       conn
  47       |> get(activity_pub_path(conn, :relay))
  48       |> json_response(404)
  49     end
  50
  51     test "on non-federating instance, it returns 404", %{conn: conn} do
  52       Config.put([:instance, :federating], false)
  53       user = insert(:user)
  54
  55       conn
  56       |> assign(:user, user)
  57       |> get(activity_pub_path(conn, :relay))
  58       |> json_response(404)
  59     end
  60   end
  61
  62   describe "/internal/fetch" do
  63     test "it returns the internal fetch user", %{conn: conn} do
  64       res =
  65         conn
  66         |> get(activity_pub_path(conn, :internal_fetch))
  67         |> json_response(200)
  68
  69       assert res["id"] =~ "/fetch"
  70     end
  71
  72     test "on non-federating instance, it returns 404", %{conn: conn} do
  73       Config.put([:instance, :federating], false)
  74       user = insert(:user)
  75
  76       conn
  77       |> assign(:user, user)
  78       |> get(activity_pub_path(conn, :internal_fetch))
  79       |> json_response(404)
  80     end
  81   end
  82
  83   describe "/users/:nickname" do
  84     test "it returns a json representation of the user with accept application/json", %{
  85       conn: conn
  86     } do
  87       user = insert(:user)
  88
  89       conn =
  90         conn
  91         |> put_req_header("accept", "application/json")
  92         |> get("/users/#{user.nickname}")
  93
  94       user = User.get_cached_by_id(user.id)
  95
  96       assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
  97     end
  98
  99     test "it returns a json representation of the user with accept application/activity+json", %{
 100       conn: conn
 101     } do
 102       user = insert(:user)
 103
 104       conn =
 105         conn
 106         |> put_req_header("accept", "application/activity+json")
 107         |> get("/users/#{user.nickname}")
 108
 109       user = User.get_cached_by_id(user.id)
 110
 111       assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
 112     end
 113
 114     test "it returns a json representation of the user with accept application/ld+json", %{
 115       conn: conn
 116     } do
 117       user = insert(:user)
 118
 119       conn =
 120         conn
 121         |> put_req_header(
 122           "accept",
 123           "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
 124         )
 125         |> get("/users/#{user.nickname}")
 126
 127       user = User.get_cached_by_id(user.id)
 128
 129       assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
 130     end
 131
 132     test "it returns 404 for remote users", %{
 133       conn: conn
 134     } do
 135       user = insert(:user, local: false, nickname: "remoteuser@example.com")
 136
 137       conn =
 138         conn
 139         |> put_req_header("accept", "application/json")
 140         |> get("/users/#{user.nickname}.json")
 141
 142       assert json_response(conn, 404)
 143     end
 144
 145     test "it returns error when user is not found", %{conn: conn} do
 146       response =
 147         conn
 148         |> put_req_header("accept", "application/json")
 149         |> get("/users/jimm")
 150         |> json_response(404)
 151
 152       assert response == "Not found"
 153     end
 154
 155     test "it requires authentication if instance is NOT federating", %{
 156       conn: conn
 157     } do
 158       user = insert(:user)
 159
 160       conn =
 161         put_req_header(
 162           conn,
 163           "accept",
 164           "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
 165         )
 166
 167       ensure_federating_or_authenticated(conn, "/users/#{user.nickname}.json", user)
 168     end
 169   end
 170
 171   describe "/objects/:uuid" do
 172     test "it returns a json representation of the object with accept application/json", %{
 173       conn: conn
 174     } do
 175       note = insert(:note)
 176       uuid = String.split(note.data["id"], "/") |> List.last()
 177
 178       conn =
 179         conn
 180         |> put_req_header("accept", "application/json")
 181         |> get("/objects/#{uuid}")
 182
 183       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
 184     end
 185
 186     test "it returns a json representation of the object with accept application/activity+json",
 187          %{conn: conn} do
 188       note = insert(:note)
 189       uuid = String.split(note.data["id"], "/") |> List.last()
 190
 191       conn =
 192         conn
 193         |> put_req_header("accept", "application/activity+json")
 194         |> get("/objects/#{uuid}")
 195
 196       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
 197     end
 198
 199     test "it returns a json representation of the object with accept application/ld+json", %{
 200       conn: conn
 201     } do
 202       note = insert(:note)
 203       uuid = String.split(note.data["id"], "/") |> List.last()
 204
 205       conn =
 206         conn
 207         |> put_req_header(
 208           "accept",
 209           "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
 210         )
 211         |> get("/objects/#{uuid}")
 212
 213       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
 214     end
 215
 216     test "it returns 404 for non-public messages", %{conn: conn} do
 217       note = insert(:direct_note)
 218       uuid = String.split(note.data["id"], "/") |> List.last()
 219
 220       conn =
 221         conn
 222         |> put_req_header("accept", "application/activity+json")
 223         |> get("/objects/#{uuid}")
 224
 225       assert json_response(conn, 404)
 226     end
 227
 228     test "it returns 404 for tombstone objects", %{conn: conn} do
 229       tombstone = insert(:tombstone)
 230       uuid = String.split(tombstone.data["id"], "/") |> List.last()
 231
 232       conn =
 233         conn
 234         |> put_req_header("accept", "application/activity+json")
 235         |> get("/objects/#{uuid}")
 236
 237       assert json_response(conn, 404)
 238     end
 239
 240     test "it caches a response", %{conn: conn} do
 241       note = insert(:note)
 242       uuid = String.split(note.data["id"], "/") |> List.last()
 243
 244       conn1 =
 245         conn
 246         |> put_req_header("accept", "application/activity+json")
 247         |> get("/objects/#{uuid}")
 248
 249       assert json_response(conn1, :ok)
 250       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 251
 252       conn2 =
 253         conn
 254         |> put_req_header("accept", "application/activity+json")
 255         |> get("/objects/#{uuid}")
 256
 257       assert json_response(conn1, :ok) == json_response(conn2, :ok)
 258       assert Enum.any?(conn2.resp_headers, &(&1 == {"x-cache", "HIT from Pleroma"}))
 259     end
 260
 261     test "cached purged after object deletion", %{conn: conn} do
 262       note = insert(:note)
 263       uuid = String.split(note.data["id"], "/") |> List.last()
 264
 265       conn1 =
 266         conn
 267         |> put_req_header("accept", "application/activity+json")
 268         |> get("/objects/#{uuid}")
 269
 270       assert json_response(conn1, :ok)
 271       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 272
 273       Object.delete(note)
 274
 275       conn2 =
 276         conn
 277         |> put_req_header("accept", "application/activity+json")
 278         |> get("/objects/#{uuid}")
 279
 280       assert "Not found" == json_response(conn2, :not_found)
 281     end
 282
 283     test "it requires authentication if instance is NOT federating", %{
 284       conn: conn
 285     } do
 286       user = insert(:user)
 287       note = insert(:note)
 288       uuid = String.split(note.data["id"], "/") |> List.last()
 289
 290       conn = put_req_header(conn, "accept", "application/activity+json")
 291
 292       ensure_federating_or_authenticated(conn, "/objects/#{uuid}", user)
 293     end
 294   end
 295
 296   describe "/activities/:uuid" do
 297     test "it returns a json representation of the activity", %{conn: conn} do
 298       activity = insert(:note_activity)
 299       uuid = String.split(activity.data["id"], "/") |> List.last()
 300
 301       conn =
 302         conn
 303         |> put_req_header("accept", "application/activity+json")
 304         |> get("/activities/#{uuid}")
 305
 306       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: activity})
 307     end
 308
 309     test "it returns 404 for non-public activities", %{conn: conn} do
 310       activity = insert(:direct_note_activity)
 311       uuid = String.split(activity.data["id"], "/") |> List.last()
 312
 313       conn =
 314         conn
 315         |> put_req_header("accept", "application/activity+json")
 316         |> get("/activities/#{uuid}")
 317
 318       assert json_response(conn, 404)
 319     end
 320
 321     test "it caches a response", %{conn: conn} do
 322       activity = insert(:note_activity)
 323       uuid = String.split(activity.data["id"], "/") |> List.last()
 324
 325       conn1 =
 326         conn
 327         |> put_req_header("accept", "application/activity+json")
 328         |> get("/activities/#{uuid}")
 329
 330       assert json_response(conn1, :ok)
 331       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 332
 333       conn2 =
 334         conn
 335         |> put_req_header("accept", "application/activity+json")
 336         |> get("/activities/#{uuid}")
 337
 338       assert json_response(conn1, :ok) == json_response(conn2, :ok)
 339       assert Enum.any?(conn2.resp_headers, &(&1 == {"x-cache", "HIT from Pleroma"}))
 340     end
 341
 342     test "cached purged after activity deletion", %{conn: conn} do
 343       user = insert(:user)
 344       {:ok, activity} = CommonAPI.post(user, %{"status" => "cofe"})
 345
 346       uuid = String.split(activity.data["id"], "/") |> List.last()
 347
 348       conn1 =
 349         conn
 350         |> put_req_header("accept", "application/activity+json")
 351         |> get("/activities/#{uuid}")
 352
 353       assert json_response(conn1, :ok)
 354       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 355
 356       Activity.delete_all_by_object_ap_id(activity.object.data["id"])
 357
 358       conn2 =
 359         conn
 360         |> put_req_header("accept", "application/activity+json")
 361         |> get("/activities/#{uuid}")
 362
 363       assert "Not found" == json_response(conn2, :not_found)
 364     end
 365
 366     test "it requires authentication if instance is NOT federating", %{
 367       conn: conn
 368     } do
 369       user = insert(:user)
 370       activity = insert(:note_activity)
 371       uuid = String.split(activity.data["id"], "/") |> List.last()
 372
 373       conn = put_req_header(conn, "accept", "application/activity+json")
 374
 375       ensure_federating_or_authenticated(conn, "/activities/#{uuid}", user)
 376     end
 377   end
 378
 379   describe "/inbox" do
 380     test "it inserts an incoming activity into the database", %{conn: conn} do
 381       data = File.read!("test/fixtures/mastodon-post-activity.json") |> Poison.decode!()
 382
 383       conn =
 384         conn
 385         |> assign(:valid_signature, true)
 386         |> put_req_header("content-type", "application/activity+json")
 387         |> post("/inbox", data)
 388
 389       assert "ok" == json_response(conn, 200)
 390
 391       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 392       assert Activity.get_by_ap_id(data["id"])
 393     end
 394
 395     test "it clears `unreachable` federation status of the sender", %{conn: conn} do
 396       data = File.read!("test/fixtures/mastodon-post-activity.json") |> Poison.decode!()
 397
 398       sender_url = data["actor"]
 399       Instances.set_consistently_unreachable(sender_url)
 400       refute Instances.reachable?(sender_url)
 401
 402       conn =
 403         conn
 404         |> assign(:valid_signature, true)
 405         |> put_req_header("content-type", "application/activity+json")
 406         |> post("/inbox", data)
 407
 408       assert "ok" == json_response(conn, 200)
 409       assert Instances.reachable?(sender_url)
 410     end
 411
 412     test "accept follow activity", %{conn: conn} do
 413       Pleroma.Config.put([:instance, :federating], true)
 414       relay = Relay.get_actor()
 415
 416       assert {:ok, %Activity{} = activity} = Relay.follow("https://relay.mastodon.host/actor")
 417
 418       followed_relay = Pleroma.User.get_by_ap_id("https://relay.mastodon.host/actor")
 419       relay = refresh_record(relay)
 420
 421       accept =
 422         File.read!("test/fixtures/relay/accept-follow.json")
 423         |> String.replace("{{ap_id}}", relay.ap_id)
 424         |> String.replace("{{activity_id}}", activity.data["id"])
 425
 426       assert "ok" ==
 427                conn
 428                |> assign(:valid_signature, true)
 429                |> put_req_header("content-type", "application/activity+json")
 430                |> post("/inbox", accept)
 431                |> json_response(200)
 432
 433       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 434
 435       assert Pleroma.FollowingRelationship.following?(
 436                relay,
 437                followed_relay
 438              )
 439
 440       Mix.shell(Mix.Shell.Process)
 441
 442       on_exit(fn ->
 443         Mix.shell(Mix.Shell.IO)
 444       end)
 445
 446       :ok = Mix.Tasks.Pleroma.Relay.run(["list"])
 447       assert_receive {:mix_shell, :info, ["relay.mastodon.host"]}
 448     end
 449
 450     test "without valid signature, " <>
 451            "it only accepts Create activities and requires enabled federation",
 452          %{conn: conn} do
 453       data = File.read!("test/fixtures/mastodon-post-activity.json") |> Poison.decode!()
 454       non_create_data = File.read!("test/fixtures/mastodon-announce.json") |> Poison.decode!()
 455
 456       conn = put_req_header(conn, "content-type", "application/activity+json")
 457
 458       Config.put([:instance, :federating], false)
 459
 460       conn
 461       |> post("/inbox", data)
 462       |> json_response(403)
 463
 464       conn
 465       |> post("/inbox", non_create_data)
 466       |> json_response(403)
 467
 468       Config.put([:instance, :federating], true)
 469
 470       ret_conn = post(conn, "/inbox", data)
 471       assert "ok" == json_response(ret_conn, 200)
 472
 473       conn
 474       |> post("/inbox", non_create_data)
 475       |> json_response(400)
 476     end
 477   end
 478
 479   describe "/users/:nickname/inbox" do
 480     setup do
 481       data =
 482         File.read!("test/fixtures/mastodon-post-activity.json")
 483         |> Poison.decode!()
 484
 485       [data: data]
 486     end
 487
 488     test "it inserts an incoming activity into the database", %{conn: conn, data: data} do
 489       user = insert(:user)
 490       data = Map.put(data, "bcc", [user.ap_id])
 491
 492       conn =
 493         conn
 494         |> assign(:valid_signature, true)
 495         |> put_req_header("content-type", "application/activity+json")
 496         |> post("/users/#{user.nickname}/inbox", data)
 497
 498       assert "ok" == json_response(conn, 200)
 499       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 500       assert Activity.get_by_ap_id(data["id"])
 501     end
 502
 503     test "it accepts messages with to as string instead of array", %{conn: conn, data: data} do
 504       user = insert(:user)
 505
 506       data =
 507         Map.put(data, "to", user.ap_id)
 508         |> Map.delete("cc")
 509
 510       conn =
 511         conn
 512         |> assign(:valid_signature, true)
 513         |> put_req_header("content-type", "application/activity+json")
 514         |> post("/users/#{user.nickname}/inbox", data)
 515
 516       assert "ok" == json_response(conn, 200)
 517       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 518       assert Activity.get_by_ap_id(data["id"])
 519     end
 520
 521     test "it accepts messages with cc as string instead of array", %{conn: conn, data: data} do
 522       user = insert(:user)
 523
 524       data =
 525         Map.put(data, "cc", user.ap_id)
 526         |> Map.delete("to")
 527
 528       conn =
 529         conn
 530         |> assign(:valid_signature, true)
 531         |> put_req_header("content-type", "application/activity+json")
 532         |> post("/users/#{user.nickname}/inbox", data)
 533
 534       assert "ok" == json_response(conn, 200)
 535       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 536       %Activity{} = activity = Activity.get_by_ap_id(data["id"])
 537       assert user.ap_id in activity.recipients
 538     end
 539
 540     test "it accepts messages with bcc as string instead of array", %{conn: conn, data: data} do
 541       user = insert(:user)
 542
 543       data =
 544         Map.put(data, "bcc", user.ap_id)
 545         |> Map.delete("to")
 546         |> Map.delete("cc")
 547
 548       conn =
 549         conn
 550         |> assign(:valid_signature, true)
 551         |> put_req_header("content-type", "application/activity+json")
 552         |> post("/users/#{user.nickname}/inbox", data)
 553
 554       assert "ok" == json_response(conn, 200)
 555       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 556       assert Activity.get_by_ap_id(data["id"])
 557     end
 558
 559     test "it accepts announces with to as string instead of array", %{conn: conn} do
 560       user = insert(:user)
 561
 562       data = %{
 563         "@context" => "https://www.w3.org/ns/activitystreams",
 564         "actor" => "http://mastodon.example.org/users/admin",
 565         "id" => "http://mastodon.example.org/users/admin/statuses/19512778738411822/activity",
 566         "object" => "https://mastodon.social/users/emelie/statuses/101849165031453009",
 567         "to" => "https://www.w3.org/ns/activitystreams#Public",
 568         "cc" => [user.ap_id],
 569         "type" => "Announce"
 570       }
 571
 572       conn =
 573         conn
 574         |> assign(:valid_signature, true)
 575         |> put_req_header("content-type", "application/activity+json")
 576         |> post("/users/#{user.nickname}/inbox", data)
 577
 578       assert "ok" == json_response(conn, 200)
 579       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 580       %Activity{} = activity = Activity.get_by_ap_id(data["id"])
 581       assert "https://www.w3.org/ns/activitystreams#Public" in activity.recipients
 582     end
 583
 584     test "it accepts messages from actors that are followed by the user", %{
 585       conn: conn,
 586       data: data
 587     } do
 588       recipient = insert(:user)
 589       actor = insert(:user, %{ap_id: "http://mastodon.example.org/users/actor"})
 590
 591       {:ok, recipient} = User.follow(recipient, actor)
 592
 593       object =
 594         data["object"]
 595         |> Map.put("attributedTo", actor.ap_id)
 596
 597       data =
 598         data
 599         |> Map.put("actor", actor.ap_id)
 600         |> Map.put("object", object)
 601
 602       conn =
 603         conn
 604         |> assign(:valid_signature, true)
 605         |> put_req_header("content-type", "application/activity+json")
 606         |> post("/users/#{recipient.nickname}/inbox", data)
 607
 608       assert "ok" == json_response(conn, 200)
 609       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 610       assert Activity.get_by_ap_id(data["id"])
 611     end
 612
 613     test "it rejects reads from other users", %{conn: conn} do
 614       user = insert(:user)
 615       other_user = insert(:user)
 616
 617       conn =
 618         conn
 619         |> assign(:user, other_user)
 620         |> put_req_header("accept", "application/activity+json")
 621         |> get("/users/#{user.nickname}/inbox")
 622
 623       assert json_response(conn, 403)
 624     end
 625
 626     test "it returns a note activity in a collection", %{conn: conn} do
 627       note_activity = insert(:direct_note_activity)
 628       note_object = Object.normalize(note_activity)
 629       user = User.get_cached_by_ap_id(hd(note_activity.data["to"]))
 630
 631       conn =
 632         conn
 633         |> assign(:user, user)
 634         |> put_req_header("accept", "application/activity+json")
 635         |> get("/users/#{user.nickname}/inbox?page=true")
 636
 637       assert response(conn, 200) =~ note_object.data["content"]
 638     end
 639
 640     test "it clears `unreachable` federation status of the sender", %{conn: conn, data: data} do
 641       user = insert(:user)
 642       data = Map.put(data, "bcc", [user.ap_id])
 643
 644       sender_host = URI.parse(data["actor"]).host
 645       Instances.set_consistently_unreachable(sender_host)
 646       refute Instances.reachable?(sender_host)
 647
 648       conn =
 649         conn
 650         |> assign(:valid_signature, true)
 651         |> put_req_header("content-type", "application/activity+json")
 652         |> post("/users/#{user.nickname}/inbox", data)
 653
 654       assert "ok" == json_response(conn, 200)
 655       assert Instances.reachable?(sender_host)
 656     end
 657
 658     test "it removes all follower collections but actor's", %{conn: conn} do
 659       [actor, recipient] = insert_pair(:user)
 660
 661       data =
 662         File.read!("test/fixtures/activitypub-client-post-activity.json")
 663         |> Poison.decode!()
 664
 665       object = Map.put(data["object"], "attributedTo", actor.ap_id)
 666
 667       data =
 668         data
 669         |> Map.put("id", Utils.generate_object_id())
 670         |> Map.put("actor", actor.ap_id)
 671         |> Map.put("object", object)
 672         |> Map.put("cc", [
 673           recipient.follower_address,
 674           actor.follower_address
 675         ])
 676         |> Map.put("to", [
 677           recipient.ap_id,
 678           recipient.follower_address,
 679           "https://www.w3.org/ns/activitystreams#Public"
 680         ])
 681
 682       conn
 683       |> assign(:valid_signature, true)
 684       |> put_req_header("content-type", "application/activity+json")
 685       |> post("/users/#{recipient.nickname}/inbox", data)
 686       |> json_response(200)
 687
 688       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 689
 690       activity = Activity.get_by_ap_id(data["id"])
 691
 692       assert activity.id
 693       assert actor.follower_address in activity.recipients
 694       assert actor.follower_address in activity.data["cc"]
 695
 696       refute recipient.follower_address in activity.recipients
 697       refute recipient.follower_address in activity.data["cc"]
 698       refute recipient.follower_address in activity.data["to"]
 699     end
 700
 701     test "it requires authentication", %{conn: conn} do
 702       user = insert(:user)
 703       conn = put_req_header(conn, "accept", "application/activity+json")
 704
 705       ret_conn = get(conn, "/users/#{user.nickname}/inbox")
 706       assert json_response(ret_conn, 403)
 707
 708       ret_conn =
 709         conn
 710         |> assign(:user, user)
 711         |> get("/users/#{user.nickname}/inbox")
 712
 713       assert json_response(ret_conn, 200)
 714     end
 715   end
 716
 717   describe "GET /users/:nickname/outbox" do
 718     test "it returns 200 even if there're no activities", %{conn: conn} do
 719       user = insert(:user)
 720
 721       conn =
 722         conn
 723         |> assign(:user, user)
 724         |> put_req_header("accept", "application/activity+json")
 725         |> get("/users/#{user.nickname}/outbox")
 726
 727       result = json_response(conn, 200)
 728       assert user.ap_id <> "/outbox" == result["id"]
 729     end
 730
 731     test "it returns a note activity in a collection", %{conn: conn} do
 732       note_activity = insert(:note_activity)
 733       note_object = Object.normalize(note_activity)
 734       user = User.get_cached_by_ap_id(note_activity.data["actor"])
 735
 736       conn =
 737         conn
 738         |> assign(:user, user)
 739         |> put_req_header("accept", "application/activity+json")
 740         |> get("/users/#{user.nickname}/outbox?page=true")
 741
 742       assert response(conn, 200) =~ note_object.data["content"]
 743     end
 744
 745     test "it returns an announce activity in a collection", %{conn: conn} do
 746       announce_activity = insert(:announce_activity)
 747       user = User.get_cached_by_ap_id(announce_activity.data["actor"])
 748
 749       conn =
 750         conn
 751         |> assign(:user, user)
 752         |> put_req_header("accept", "application/activity+json")
 753         |> get("/users/#{user.nickname}/outbox?page=true")
 754
 755       assert response(conn, 200) =~ announce_activity.data["object"]
 756     end
 757
 758     test "it requires authentication if instance is NOT federating", %{
 759       conn: conn
 760     } do
 761       user = insert(:user)
 762       conn = put_req_header(conn, "accept", "application/activity+json")
 763
 764       ensure_federating_or_authenticated(conn, "/users/#{user.nickname}/outbox", user)
 765     end
 766   end
 767
 768   describe "POST /users/:nickname/outbox (C2S)" do
 769     setup do
 770       [
 771         activity: %{
 772           "@context" => "https://www.w3.org/ns/activitystreams",
 773           "type" => "Create",
 774           "object" => %{"type" => "Note", "content" => "AP C2S test"},
 775           "to" => "https://www.w3.org/ns/activitystreams#Public",
 776           "cc" => []
 777         }
 778       ]
 779     end
 780
 781     test "it rejects posts from other users / unauthenticated users", %{
 782       conn: conn,
 783       activity: activity
 784     } do
 785       user = insert(:user)
 786       other_user = insert(:user)
 787       conn = put_req_header(conn, "content-type", "application/activity+json")
 788
 789       conn
 790       |> post("/users/#{user.nickname}/outbox", activity)
 791       |> json_response(403)
 792
 793       conn
 794       |> assign(:user, other_user)
 795       |> post("/users/#{user.nickname}/outbox", activity)
 796       |> json_response(403)
 797     end
 798
 799     test "it inserts an incoming create activity into the database", %{
 800       conn: conn,
 801       activity: activity
 802     } do
 803       user = insert(:user)
 804
 805       result =
 806         conn
 807         |> assign(:user, user)
 808         |> put_req_header("content-type", "application/activity+json")
 809         |> post("/users/#{user.nickname}/outbox", activity)
 810         |> json_response(201)
 811
 812       assert Activity.get_by_ap_id(result["id"])
 813       assert result["object"]
 814       assert %Object{data: object} = Object.normalize(result["object"])
 815       assert object["content"] == activity["object"]["content"]
 816     end
 817
 818     test "it rejects anything beyond 'Note' creations", %{conn: conn, activity: activity} do
 819       user = insert(:user)
 820
 821       activity =
 822         activity
 823         |> put_in(["object", "type"], "Benis")
 824
 825       _result =
 826         conn
 827         |> assign(:user, user)
 828         |> put_req_header("content-type", "application/activity+json")
 829         |> post("/users/#{user.nickname}/outbox", activity)
 830         |> json_response(400)
 831     end
 832
 833     test "it inserts an incoming sensitive activity into the database", %{
 834       conn: conn,
 835       activity: activity
 836     } do
 837       user = insert(:user)
 838       object = Map.put(activity["object"], "sensitive", true)
 839       activity = Map.put(activity, "object", object)
 840
 841       result =
 842         conn
 843         |> assign(:user, user)
 844         |> put_req_header("content-type", "application/activity+json")
 845         |> post("/users/#{user.nickname}/outbox", activity)
 846         |> json_response(201)
 847
 848       assert Activity.get_by_ap_id(result["id"])
 849       assert result["object"]
 850       assert %Object{data: object} = Object.normalize(result["object"])
 851       assert object["sensitive"] == activity["object"]["sensitive"]
 852       assert object["content"] == activity["object"]["content"]
 853     end
 854
 855     test "it rejects an incoming activity with bogus type", %{conn: conn, activity: activity} do
 856       user = insert(:user)
 857       activity = Map.put(activity, "type", "BadType")
 858
 859       conn =
 860         conn
 861         |> assign(:user, user)
 862         |> put_req_header("content-type", "application/activity+json")
 863         |> post("/users/#{user.nickname}/outbox", activity)
 864
 865       assert json_response(conn, 400)
 866     end
 867
 868     test "it erects a tombstone when receiving a delete activity", %{conn: conn} do
 869       note_activity = insert(:note_activity)
 870       note_object = Object.normalize(note_activity)
 871       user = User.get_cached_by_ap_id(note_activity.data["actor"])
 872
 873       data = %{
 874         type: "Delete",
 875         object: %{
 876           id: note_object.data["id"]
 877         }
 878       }
 879
 880       conn =
 881         conn
 882         |> assign(:user, user)
 883         |> put_req_header("content-type", "application/activity+json")
 884         |> post("/users/#{user.nickname}/outbox", data)
 885
 886       result = json_response(conn, 201)
 887       assert Activity.get_by_ap_id(result["id"])
 888
 889       assert object = Object.get_by_ap_id(note_object.data["id"])
 890       assert object.data["type"] == "Tombstone"
 891     end
 892
 893     test "it rejects delete activity of object from other actor", %{conn: conn} do
 894       note_activity = insert(:note_activity)
 895       note_object = Object.normalize(note_activity)
 896       user = insert(:user)
 897
 898       data = %{
 899         type: "Delete",
 900         object: %{
 901           id: note_object.data["id"]
 902         }
 903       }
 904
 905       conn =
 906         conn
 907         |> assign(:user, user)
 908         |> put_req_header("content-type", "application/activity+json")
 909         |> post("/users/#{user.nickname}/outbox", data)
 910
 911       assert json_response(conn, 400)
 912     end
 913
 914     test "it increases like count when receiving a like action", %{conn: conn} do
 915       note_activity = insert(:note_activity)
 916       note_object = Object.normalize(note_activity)
 917       user = User.get_cached_by_ap_id(note_activity.data["actor"])
 918
 919       data = %{
 920         type: "Like",
 921         object: %{
 922           id: note_object.data["id"]
 923         }
 924       }
 925
 926       conn =
 927         conn
 928         |> assign(:user, user)
 929         |> put_req_header("content-type", "application/activity+json")
 930         |> post("/users/#{user.nickname}/outbox", data)
 931
 932       result = json_response(conn, 201)
 933       assert Activity.get_by_ap_id(result["id"])
 934
 935       assert object = Object.get_by_ap_id(note_object.data["id"])
 936       assert object.data["like_count"] == 1
 937     end
 938   end
 939
 940   describe "/relay/followers" do
 941     test "it returns relay followers", %{conn: conn} do
 942       relay_actor = Relay.get_actor()
 943       user = insert(:user)
 944       User.follow(user, relay_actor)
 945
 946       result =
 947         conn
 948         |> get("/relay/followers")
 949         |> json_response(200)
 950
 951       assert result["first"]["orderedItems"] == [user.ap_id]
 952     end
 953
 954     test "on non-federating instance, it returns 404", %{conn: conn} do
 955       Config.put([:instance, :federating], false)
 956       user = insert(:user)
 957
 958       conn
 959       |> assign(:user, user)
 960       |> get("/relay/followers")
 961       |> json_response(404)
 962     end
 963   end
 964
 965   describe "/relay/following" do
 966     test "it returns relay following", %{conn: conn} do
 967       result =
 968         conn
 969         |> get("/relay/following")
 970         |> json_response(200)
 971
 972       assert result["first"]["orderedItems"] == []
 973     end
 974
 975     test "on non-federating instance, it returns 404", %{conn: conn} do
 976       Config.put([:instance, :federating], false)
 977       user = insert(:user)
 978
 979       conn
 980       |> assign(:user, user)
 981       |> get("/relay/following")
 982       |> json_response(404)
 983     end
 984   end
 985
 986   describe "/users/:nickname/followers" do
 987     test "it returns the followers in a collection", %{conn: conn} do
 988       user = insert(:user)
 989       user_two = insert(:user)
 990       User.follow(user, user_two)
 991
 992       result =
 993         conn
 994         |> assign(:user, user_two)
 995         |> get("/users/#{user_two.nickname}/followers")
 996         |> json_response(200)
 997
 998       assert result["first"]["orderedItems"] == [user.ap_id]
 999     end
1000
1001     test "it returns a uri if the user has 'hide_followers' set", %{conn: conn} do
1002       user = insert(:user)
1003       user_two = insert(:user, hide_followers: true)
1004       User.follow(user, user_two)
1005
1006       result =
1007         conn
1008         |> assign(:user, user)
1009         |> get("/users/#{user_two.nickname}/followers")
1010         |> json_response(200)
1011
1012       assert is_binary(result["first"])
1013     end
1014
1015     test "it returns a 403 error on pages, if the user has 'hide_followers' set and the request is from another user",
1016          %{conn: conn} do
1017       user = insert(:user)
1018       other_user = insert(:user, hide_followers: true)
1019
1020       result =
1021         conn
1022         |> assign(:user, user)
1023         |> get("/users/#{other_user.nickname}/followers?page=1")
1024
1025       assert result.status == 403
1026       assert result.resp_body == ""
1027     end
1028
1029     test "it renders the page, if the user has 'hide_followers' set and the request is authenticated with the same user",
1030          %{conn: conn} do
1031       user = insert(:user, hide_followers: true)
1032       other_user = insert(:user)
1033       {:ok, _other_user, user, _activity} = CommonAPI.follow(other_user, user)
1034
1035       result =
1036         conn
1037         |> assign(:user, user)
1038         |> get("/users/#{user.nickname}/followers?page=1")
1039         |> json_response(200)
1040
1041       assert result["totalItems"] == 1
1042       assert result["orderedItems"] == [other_user.ap_id]
1043     end
1044
1045     test "it works for more than 10 users", %{conn: conn} do
1046       user = insert(:user)
1047
1048       Enum.each(1..15, fn _ ->
1049         other_user = insert(:user)
1050         User.follow(other_user, user)
1051       end)
1052
1053       result =
1054         conn
1055         |> assign(:user, user)
1056         |> get("/users/#{user.nickname}/followers")
1057         |> json_response(200)
1058
1059       assert length(result["first"]["orderedItems"]) == 10
1060       assert result["first"]["totalItems"] == 15
1061       assert result["totalItems"] == 15
1062
1063       result =
1064         conn
1065         |> assign(:user, user)
1066         |> get("/users/#{user.nickname}/followers?page=2")
1067         |> json_response(200)
1068
1069       assert length(result["orderedItems"]) == 5
1070       assert result["totalItems"] == 15
1071     end
1072
1073     test "does not require authentication", %{conn: conn} do
1074       user = insert(:user)
1075
1076       conn
1077       |> get("/users/#{user.nickname}/followers")
1078       |> json_response(200)
1079     end
1080   end
1081
1082   describe "/users/:nickname/following" do
1083     test "it returns the following in a collection", %{conn: conn} do
1084       user = insert(:user)
1085       user_two = insert(:user)
1086       User.follow(user, user_two)
1087
1088       result =
1089         conn
1090         |> assign(:user, user)
1091         |> get("/users/#{user.nickname}/following")
1092         |> json_response(200)
1093
1094       assert result["first"]["orderedItems"] == [user_two.ap_id]
1095     end
1096
1097     test "it returns a uri if the user has 'hide_follows' set", %{conn: conn} do
1098       user = insert(:user)
1099       user_two = insert(:user, hide_follows: true)
1100       User.follow(user, user_two)
1101
1102       result =
1103         conn
1104         |> assign(:user, user)
1105         |> get("/users/#{user_two.nickname}/following")
1106         |> json_response(200)
1107
1108       assert is_binary(result["first"])
1109     end
1110
1111     test "it returns a 403 error on pages, if the user has 'hide_follows' set and the request is from another user",
1112          %{conn: conn} do
1113       user = insert(:user)
1114       user_two = insert(:user, hide_follows: true)
1115
1116       result =
1117         conn
1118         |> assign(:user, user)
1119         |> get("/users/#{user_two.nickname}/following?page=1")
1120
1121       assert result.status == 403
1122       assert result.resp_body == ""
1123     end
1124
1125     test "it renders the page, if the user has 'hide_follows' set and the request is authenticated with the same user",
1126          %{conn: conn} do
1127       user = insert(:user, hide_follows: true)
1128       other_user = insert(:user)
1129       {:ok, user, _other_user, _activity} = CommonAPI.follow(user, other_user)
1130
1131       result =
1132         conn
1133         |> assign(:user, user)
1134         |> get("/users/#{user.nickname}/following?page=1")
1135         |> json_response(200)
1136
1137       assert result["totalItems"] == 1
1138       assert result["orderedItems"] == [other_user.ap_id]
1139     end
1140
1141     test "it works for more than 10 users", %{conn: conn} do
1142       user = insert(:user)
1143
1144       Enum.each(1..15, fn _ ->
1145         user = User.get_cached_by_id(user.id)
1146         other_user = insert(:user)
1147         User.follow(user, other_user)
1148       end)
1149
1150       result =
1151         conn
1152         |> assign(:user, user)
1153         |> get("/users/#{user.nickname}/following")
1154         |> json_response(200)
1155
1156       assert length(result["first"]["orderedItems"]) == 10
1157       assert result["first"]["totalItems"] == 15
1158       assert result["totalItems"] == 15
1159
1160       result =
1161         conn
1162         |> assign(:user, user)
1163         |> get("/users/#{user.nickname}/following?page=2")
1164         |> json_response(200)
1165
1166       assert length(result["orderedItems"]) == 5
1167       assert result["totalItems"] == 15
1168     end
1169
1170     test "does not require authentication", %{conn: conn} do
1171       user = insert(:user)
1172
1173       conn
1174       |> get("/users/#{user.nickname}/following")
1175       |> json_response(200)
1176     end
1177   end
1178
1179   describe "delivery tracking" do
1180     test "it tracks a signed object fetch", %{conn: conn} do
1181       user = insert(:user, local: false)
1182       activity = insert(:note_activity)
1183       object = Object.normalize(activity)
1184
1185       object_path = String.trim_leading(object.data["id"], Pleroma.Web.Endpoint.url())
1186
1187       conn
1188       |> put_req_header("accept", "application/activity+json")
1189       |> assign(:user, user)
1190       |> get(object_path)
1191       |> json_response(200)
1192
1193       assert Delivery.get(object.id, user.id)
1194     end
1195
1196     test "it tracks a signed activity fetch", %{conn: conn} do
1197       user = insert(:user, local: false)
1198       activity = insert(:note_activity)
1199       object = Object.normalize(activity)
1200
1201       activity_path = String.trim_leading(activity.data["id"], Pleroma.Web.Endpoint.url())
1202
1203       conn
1204       |> put_req_header("accept", "application/activity+json")
1205       |> assign(:user, user)
1206       |> get(activity_path)
1207       |> json_response(200)
1208
1209       assert Delivery.get(object.id, user.id)
1210     end
1211
1212     test "it tracks a signed object fetch when the json is cached", %{conn: conn} do
1213       user = insert(:user, local: false)
1214       other_user = insert(:user, local: false)
1215       activity = insert(:note_activity)
1216       object = Object.normalize(activity)
1217
1218       object_path = String.trim_leading(object.data["id"], Pleroma.Web.Endpoint.url())
1219
1220       conn
1221       |> put_req_header("accept", "application/activity+json")
1222       |> assign(:user, user)
1223       |> get(object_path)
1224       |> json_response(200)
1225
1226       build_conn()
1227       |> put_req_header("accept", "application/activity+json")
1228       |> assign(:user, other_user)
1229       |> get(object_path)
1230       |> json_response(200)
1231
1232       assert Delivery.get(object.id, user.id)
1233       assert Delivery.get(object.id, other_user.id)
1234     end
1235
1236     test "it tracks a signed activity fetch when the json is cached", %{conn: conn} do
1237       user = insert(:user, local: false)
1238       other_user = insert(:user, local: false)
1239       activity = insert(:note_activity)
1240       object = Object.normalize(activity)
1241
1242       activity_path = String.trim_leading(activity.data["id"], Pleroma.Web.Endpoint.url())
1243
1244       conn
1245       |> put_req_header("accept", "application/activity+json")
1246       |> assign(:user, user)
1247       |> get(activity_path)
1248       |> json_response(200)
1249
1250       build_conn()
1251       |> put_req_header("accept", "application/activity+json")
1252       |> assign(:user, other_user)
1253       |> get(activity_path)
1254       |> json_response(200)
1255
1256       assert Delivery.get(object.id, user.id)
1257       assert Delivery.get(object.id, other_user.id)
1258     end
1259   end
1260
1261   describe "Additional ActivityPub C2S endpoints" do
1262     test "GET /api/ap/whoami", %{conn: conn} do
1263       user = insert(:user)
1264
1265       conn =
1266         conn
1267         |> assign(:user, user)
1268         |> get("/api/ap/whoami")
1269
1270       user = User.get_cached_by_id(user.id)
1271
1272       assert UserView.render("user.json", %{user: user}) == json_response(conn, 200)
1273
1274       conn
1275       |> get("/api/ap/whoami")
1276       |> json_response(403)
1277     end
1278
1279     setup do: clear_config([:media_proxy])
1280     setup do: clear_config([Pleroma.Upload])
1281
1282     test "POST /api/ap/upload_media", %{conn: conn} do
1283       user = insert(:user)
1284
1285       desc = "Description of the image"
1286
1287       image = %Plug.Upload{
1288         content_type: "image/jpg",
1289         path: Path.absname("test/fixtures/image.jpg"),
1290         filename: "an_image.jpg"
1291       }
1292
1293       object =
1294         conn
1295         |> assign(:user, user)
1296         |> post("/api/ap/upload_media", %{"file" => image, "description" => desc})
1297         |> json_response(:created)
1298
1299       assert object["name"] == desc
1300       assert object["type"] == "Document"
1301       assert object["actor"] == user.ap_id
1302       assert [%{"href" => object_href, "mediaType" => object_mediatype}] = object["url"]
1303       assert is_binary(object_href)
1304       assert object_mediatype == "image/jpeg"
1305
1306       activity_request = %{
1307         "@context" => "https://www.w3.org/ns/activitystreams",
1308         "type" => "Create",
1309         "object" => %{
1310           "type" => "Note",
1311           "content" => "AP C2S test, attachment",
1312           "attachment" => [object]
1313         },
1314         "to" => "https://www.w3.org/ns/activitystreams#Public",
1315         "cc" => []
1316       }
1317
1318       activity_response =
1319         conn
1320         |> assign(:user, user)
1321         |> post("/users/#{user.nickname}/outbox", activity_request)
1322         |> json_response(:created)
1323
1324       assert activity_response["id"]
1325       assert activity_response["object"]
1326       assert activity_response["actor"] == user.ap_id
1327
1328       assert %Object{data: %{"attachment" => [attachment]}} =
1329                Object.normalize(activity_response["object"])
1330
1331       assert attachment["type"] == "Document"
1332       assert attachment["name"] == desc
1333
1334       assert [
1335                %{
1336                  "href" => ^object_href,
1337                  "type" => "Link",
1338                  "mediaType" => ^object_mediatype
1339                }
1340              ] = attachment["url"]
1341
1342       # Fails if unauthenticated
1343       conn
1344       |> post("/api/ap/upload_media", %{"file" => image, "description" => desc})
1345       |> json_response(403)
1346     end
1347   end
1348 end