git.squeep.com Git - akkoma/blob - test/web/activity_pub/activity_pub_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
   6   use Pleroma.Web.ConnCase
   7   use Oban.Testing, repo: Pleroma.Repo
   8
   9   import Pleroma.Factory
  10   alias Pleroma.Activity
  11   alias Pleroma.Config
  12   alias Pleroma.Delivery
  13   alias Pleroma.Instances
  14   alias Pleroma.Object
  15   alias Pleroma.Tests.ObanHelpers
  16   alias Pleroma.User
  17   alias Pleroma.Web.ActivityPub.ObjectView
  18   alias Pleroma.Web.ActivityPub.Relay
  19   alias Pleroma.Web.ActivityPub.UserView
  20   alias Pleroma.Web.ActivityPub.Utils
  21   alias Pleroma.Web.CommonAPI
  22   alias Pleroma.Workers.ReceiverWorker
  23
  24   setup_all do
  25     Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
  26     :ok
  27   end
  28
  29   setup do: clear_config([:instance, :federating], true)
  30
  31   describe "/relay" do
  32     setup do: clear_config([:instance, :allow_relay])
  33
  34     test "with the relay active, it returns the relay user", %{conn: conn} do
  35       res =
  36         conn
  37         |> get(activity_pub_path(conn, :relay))
  38         |> json_response(200)
  39
  40       assert res["id"] =~ "/relay"
  41     end
  42
  43     test "with the relay disabled, it returns 404", %{conn: conn} do
  44       Config.put([:instance, :allow_relay], false)
  45
  46       conn
  47       |> get(activity_pub_path(conn, :relay))
  48       |> json_response(404)
  49     end
  50
  51     test "on non-federating instance, it returns 404", %{conn: conn} do
  52       Config.put([:instance, :federating], false)
  53       user = insert(:user)
  54
  55       conn
  56       |> assign(:user, user)
  57       |> get(activity_pub_path(conn, :relay))
  58       |> json_response(404)
  59     end
  60   end
  61
  62   describe "/internal/fetch" do
  63     test "it returns the internal fetch user", %{conn: conn} do
  64       res =
  65         conn
  66         |> get(activity_pub_path(conn, :internal_fetch))
  67         |> json_response(200)
  68
  69       assert res["id"] =~ "/fetch"
  70     end
  71
  72     test "on non-federating instance, it returns 404", %{conn: conn} do
  73       Config.put([:instance, :federating], false)
  74       user = insert(:user)
  75
  76       conn
  77       |> assign(:user, user)
  78       |> get(activity_pub_path(conn, :internal_fetch))
  79       |> json_response(404)
  80     end
  81   end
  82
  83   describe "/users/:nickname" do
  84     test "it returns a json representation of the user with accept application/json", %{
  85       conn: conn
  86     } do
  87       user = insert(:user)
  88
  89       conn =
  90         conn
  91         |> put_req_header("accept", "application/json")
  92         |> get("/users/#{user.nickname}")
  93
  94       user = User.get_cached_by_id(user.id)
  95
  96       assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
  97     end
  98
  99     test "it returns a json representation of the user with accept application/activity+json", %{
 100       conn: conn
 101     } do
 102       user = insert(:user)
 103
 104       conn =
 105         conn
 106         |> put_req_header("accept", "application/activity+json")
 107         |> get("/users/#{user.nickname}")
 108
 109       user = User.get_cached_by_id(user.id)
 110
 111       assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
 112     end
 113
 114     test "it returns a json representation of the user with accept application/ld+json", %{
 115       conn: conn
 116     } do
 117       user = insert(:user)
 118
 119       conn =
 120         conn
 121         |> put_req_header(
 122           "accept",
 123           "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
 124         )
 125         |> get("/users/#{user.nickname}")
 126
 127       user = User.get_cached_by_id(user.id)
 128
 129       assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
 130     end
 131
 132     test "it returns 404 for remote users", %{
 133       conn: conn
 134     } do
 135       user = insert(:user, local: false, nickname: "remoteuser@example.com")
 136
 137       conn =
 138         conn
 139         |> put_req_header("accept", "application/json")
 140         |> get("/users/#{user.nickname}.json")
 141
 142       assert json_response(conn, 404)
 143     end
 144
 145     test "it returns error when user is not found", %{conn: conn} do
 146       response =
 147         conn
 148         |> put_req_header("accept", "application/json")
 149         |> get("/users/jimm")
 150         |> json_response(404)
 151
 152       assert response == "Not found"
 153     end
 154
 155     test "it requires authentication if instance is NOT federating", %{
 156       conn: conn
 157     } do
 158       user = insert(:user)
 159
 160       conn =
 161         put_req_header(
 162           conn,
 163           "accept",
 164           "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
 165         )
 166
 167       ensure_federating_or_authenticated(conn, "/users/#{user.nickname}.json", user)
 168     end
 169   end
 170
 171   describe "/objects/:uuid" do
 172     test "it returns a json representation of the object with accept application/json", %{
 173       conn: conn
 174     } do
 175       note = insert(:note)
 176       uuid = String.split(note.data["id"], "/") |> List.last()
 177
 178       conn =
 179         conn
 180         |> put_req_header("accept", "application/json")
 181         |> get("/objects/#{uuid}")
 182
 183       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
 184     end
 185
 186     test "it returns a json representation of the object with accept application/activity+json",
 187          %{conn: conn} do
 188       note = insert(:note)
 189       uuid = String.split(note.data["id"], "/") |> List.last()
 190
 191       conn =
 192         conn
 193         |> put_req_header("accept", "application/activity+json")
 194         |> get("/objects/#{uuid}")
 195
 196       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
 197     end
 198
 199     test "it returns a json representation of the object with accept application/ld+json", %{
 200       conn: conn
 201     } do
 202       note = insert(:note)
 203       uuid = String.split(note.data["id"], "/") |> List.last()
 204
 205       conn =
 206         conn
 207         |> put_req_header(
 208           "accept",
 209           "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
 210         )
 211         |> get("/objects/#{uuid}")
 212
 213       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
 214     end
 215
 216     test "it returns 404 for non-public messages", %{conn: conn} do
 217       note = insert(:direct_note)
 218       uuid = String.split(note.data["id"], "/") |> List.last()
 219
 220       conn =
 221         conn
 222         |> put_req_header("accept", "application/activity+json")
 223         |> get("/objects/#{uuid}")
 224
 225       assert json_response(conn, 404)
 226     end
 227
 228     test "it returns 404 for tombstone objects", %{conn: conn} do
 229       tombstone = insert(:tombstone)
 230       uuid = String.split(tombstone.data["id"], "/") |> List.last()
 231
 232       conn =
 233         conn
 234         |> put_req_header("accept", "application/activity+json")
 235         |> get("/objects/#{uuid}")
 236
 237       assert json_response(conn, 404)
 238     end
 239
 240     test "it caches a response", %{conn: conn} do
 241       note = insert(:note)
 242       uuid = String.split(note.data["id"], "/") |> List.last()
 243
 244       conn1 =
 245         conn
 246         |> put_req_header("accept", "application/activity+json")
 247         |> get("/objects/#{uuid}")
 248
 249       assert json_response(conn1, :ok)
 250       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 251
 252       conn2 =
 253         conn
 254         |> put_req_header("accept", "application/activity+json")
 255         |> get("/objects/#{uuid}")
 256
 257       assert json_response(conn1, :ok) == json_response(conn2, :ok)
 258       assert Enum.any?(conn2.resp_headers, &(&1 == {"x-cache", "HIT from Pleroma"}))
 259     end
 260
 261     test "cached purged after object deletion", %{conn: conn} do
 262       note = insert(:note)
 263       uuid = String.split(note.data["id"], "/") |> List.last()
 264
 265       conn1 =
 266         conn
 267         |> put_req_header("accept", "application/activity+json")
 268         |> get("/objects/#{uuid}")
 269
 270       assert json_response(conn1, :ok)
 271       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 272
 273       Object.delete(note)
 274
 275       conn2 =
 276         conn
 277         |> put_req_header("accept", "application/activity+json")
 278         |> get("/objects/#{uuid}")
 279
 280       assert "Not found" == json_response(conn2, :not_found)
 281     end
 282
 283     test "it requires authentication if instance is NOT federating", %{
 284       conn: conn
 285     } do
 286       user = insert(:user)
 287       note = insert(:note)
 288       uuid = String.split(note.data["id"], "/") |> List.last()
 289
 290       conn = put_req_header(conn, "accept", "application/activity+json")
 291
 292       ensure_federating_or_authenticated(conn, "/objects/#{uuid}", user)
 293     end
 294   end
 295
 296   describe "/activities/:uuid" do
 297     test "it returns a json representation of the activity", %{conn: conn} do
 298       activity = insert(:note_activity)
 299       uuid = String.split(activity.data["id"], "/") |> List.last()
 300
 301       conn =
 302         conn
 303         |> put_req_header("accept", "application/activity+json")
 304         |> get("/activities/#{uuid}")
 305
 306       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: activity})
 307     end
 308
 309     test "it returns 404 for non-public activities", %{conn: conn} do
 310       activity = insert(:direct_note_activity)
 311       uuid = String.split(activity.data["id"], "/") |> List.last()
 312
 313       conn =
 314         conn
 315         |> put_req_header("accept", "application/activity+json")
 316         |> get("/activities/#{uuid}")
 317
 318       assert json_response(conn, 404)
 319     end
 320
 321     test "it caches a response", %{conn: conn} do
 322       activity = insert(:note_activity)
 323       uuid = String.split(activity.data["id"], "/") |> List.last()
 324
 325       conn1 =
 326         conn
 327         |> put_req_header("accept", "application/activity+json")
 328         |> get("/activities/#{uuid}")
 329
 330       assert json_response(conn1, :ok)
 331       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 332
 333       conn2 =
 334         conn
 335         |> put_req_header("accept", "application/activity+json")
 336         |> get("/activities/#{uuid}")
 337
 338       assert json_response(conn1, :ok) == json_response(conn2, :ok)
 339       assert Enum.any?(conn2.resp_headers, &(&1 == {"x-cache", "HIT from Pleroma"}))
 340     end
 341
 342     test "cached purged after activity deletion", %{conn: conn} do
 343       user = insert(:user)
 344       {:ok, activity} = CommonAPI.post(user, %{"status" => "cofe"})
 345
 346       uuid = String.split(activity.data["id"], "/") |> List.last()
 347
 348       conn1 =
 349         conn
 350         |> put_req_header("accept", "application/activity+json")
 351         |> get("/activities/#{uuid}")
 352
 353       assert json_response(conn1, :ok)
 354       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 355
 356       Activity.delete_all_by_object_ap_id(activity.object.data["id"])
 357
 358       conn2 =
 359         conn
 360         |> put_req_header("accept", "application/activity+json")
 361         |> get("/activities/#{uuid}")
 362
 363       assert "Not found" == json_response(conn2, :not_found)
 364     end
 365
 366     test "it requires authentication if instance is NOT federating", %{
 367       conn: conn
 368     } do
 369       user = insert(:user)
 370       activity = insert(:note_activity)
 371       uuid = String.split(activity.data["id"], "/") |> List.last()
 372
 373       conn = put_req_header(conn, "accept", "application/activity+json")
 374
 375       ensure_federating_or_authenticated(conn, "/activities/#{uuid}", user)
 376     end
 377   end
 378
 379   describe "/inbox" do
 380     test "it inserts an incoming activity into the database", %{conn: conn} do
 381       data = File.read!("test/fixtures/mastodon-post-activity.json") |> Poison.decode!()
 382
 383       conn =
 384         conn
 385         |> assign(:valid_signature, true)
 386         |> put_req_header("content-type", "application/activity+json")
 387         |> post("/inbox", data)
 388
 389       assert "ok" == json_response(conn, 200)
 390
 391       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 392       assert Activity.get_by_ap_id(data["id"])
 393     end
 394
 395     test "it clears `unreachable` federation status of the sender", %{conn: conn} do
 396       data = File.read!("test/fixtures/mastodon-post-activity.json") |> Poison.decode!()
 397
 398       sender_url = data["actor"]
 399       Instances.set_consistently_unreachable(sender_url)
 400       refute Instances.reachable?(sender_url)
 401
 402       conn =
 403         conn
 404         |> assign(:valid_signature, true)
 405         |> put_req_header("content-type", "application/activity+json")
 406         |> post("/inbox", data)
 407
 408       assert "ok" == json_response(conn, 200)
 409       assert Instances.reachable?(sender_url)
 410     end
 411
 412     test "accept follow activity", %{conn: conn} do
 413       Pleroma.Config.put([:instance, :federating], true)
 414       relay = Relay.get_actor()
 415
 416       assert {:ok, %Activity{} = activity} = Relay.follow("https://relay.mastodon.host/actor")
 417
 418       followed_relay = Pleroma.User.get_by_ap_id("https://relay.mastodon.host/actor")
 419       relay = refresh_record(relay)
 420
 421       accept =
 422         File.read!("test/fixtures/relay/accept-follow.json")
 423         |> String.replace("{{ap_id}}", relay.ap_id)
 424         |> String.replace("{{activity_id}}", activity.data["id"])
 425
 426       assert "ok" ==
 427                conn
 428                |> assign(:valid_signature, true)
 429                |> put_req_header("content-type", "application/activity+json")
 430                |> post("/inbox", accept)
 431                |> json_response(200)
 432
 433       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 434
 435       assert Pleroma.FollowingRelationship.following?(
 436                relay,
 437                followed_relay
 438              )
 439
 440       Mix.shell(Mix.Shell.Process)
 441
 442       on_exit(fn ->
 443         Mix.shell(Mix.Shell.IO)
 444       end)
 445
 446       :ok = Mix.Tasks.Pleroma.Relay.run(["list"])
 447       assert_receive {:mix_shell, :info, ["relay.mastodon.host"]}
 448     end
 449
 450     test "without valid signature, " <>
 451            "it only accepts Create activities and requires enabled federation",
 452          %{conn: conn} do
 453       data = File.read!("test/fixtures/mastodon-post-activity.json") |> Poison.decode!()
 454       non_create_data = File.read!("test/fixtures/mastodon-announce.json") |> Poison.decode!()
 455
 456       conn = put_req_header(conn, "content-type", "application/activity+json")
 457
 458       Config.put([:instance, :federating], false)
 459
 460       conn
 461       |> post("/inbox", data)
 462       |> json_response(403)
 463
 464       conn
 465       |> post("/inbox", non_create_data)
 466       |> json_response(403)
 467
 468       Config.put([:instance, :federating], true)
 469
 470       ret_conn = post(conn, "/inbox", data)
 471       assert "ok" == json_response(ret_conn, 200)
 472
 473       conn
 474       |> post("/inbox", non_create_data)
 475       |> json_response(400)
 476     end
 477   end
 478
 479   describe "/users/:nickname/inbox" do
 480     setup do
 481       data =
 482         File.read!("test/fixtures/mastodon-post-activity.json")
 483         |> Poison.decode!()
 484
 485       [data: data]
 486     end
 487
 488     test "it inserts an incoming activity into the database", %{conn: conn, data: data} do
 489       user = insert(:user)
 490       data = Map.put(data, "bcc", [user.ap_id])
 491
 492       conn =
 493         conn
 494         |> assign(:valid_signature, true)
 495         |> put_req_header("content-type", "application/activity+json")
 496         |> post("/users/#{user.nickname}/inbox", data)
 497
 498       assert "ok" == json_response(conn, 200)
 499       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 500       assert Activity.get_by_ap_id(data["id"])
 501     end
 502
 503     test "it accepts messages with to as string instead of array", %{conn: conn, data: data} do
 504       user = insert(:user)
 505
 506       data =
 507         Map.put(data, "to", user.ap_id)
 508         |> Map.delete("cc")
 509
 510       conn =
 511         conn
 512         |> assign(:valid_signature, true)
 513         |> put_req_header("content-type", "application/activity+json")
 514         |> post("/users/#{user.nickname}/inbox", data)
 515
 516       assert "ok" == json_response(conn, 200)
 517       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 518       assert Activity.get_by_ap_id(data["id"])
 519     end
 520
 521     test "it accepts messages with cc as string instead of array", %{conn: conn, data: data} do
 522       user = insert(:user)
 523
 524       data =
 525         Map.put(data, "cc", user.ap_id)
 526         |> Map.delete("to")
 527
 528       conn =
 529         conn
 530         |> assign(:valid_signature, true)
 531         |> put_req_header("content-type", "application/activity+json")
 532         |> post("/users/#{user.nickname}/inbox", data)
 533
 534       assert "ok" == json_response(conn, 200)
 535       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 536       %Activity{} = activity = Activity.get_by_ap_id(data["id"])
 537       assert user.ap_id in activity.recipients
 538     end
 539
 540     test "it accepts messages with bcc as string instead of array", %{conn: conn, data: data} do
 541       user = insert(:user)
 542
 543       data =
 544         Map.put(data, "bcc", user.ap_id)
 545         |> Map.delete("to")
 546         |> Map.delete("cc")
 547
 548       conn =
 549         conn
 550         |> assign(:valid_signature, true)
 551         |> put_req_header("content-type", "application/activity+json")
 552         |> post("/users/#{user.nickname}/inbox", data)
 553
 554       assert "ok" == json_response(conn, 200)
 555       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 556       assert Activity.get_by_ap_id(data["id"])
 557     end
 558
 559     test "it accepts announces with to as string instead of array", %{conn: conn} do
 560       user = insert(:user)
 561
 562       data = %{
 563         "@context" => "https://www.w3.org/ns/activitystreams",
 564         "actor" => "http://mastodon.example.org/users/admin",
 565         "id" => "http://mastodon.example.org/users/admin/statuses/19512778738411822/activity",
 566         "object" => "https://mastodon.social/users/emelie/statuses/101849165031453009",
 567         "to" => "https://www.w3.org/ns/activitystreams#Public",
 568         "cc" => [user.ap_id],
 569         "type" => "Announce"
 570       }
 571
 572       conn =
 573         conn
 574         |> assign(:valid_signature, true)
 575         |> put_req_header("content-type", "application/activity+json")
 576         |> post("/users/#{user.nickname}/inbox", data)
 577
 578       assert "ok" == json_response(conn, 200)
 579       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 580       %Activity{} = activity = Activity.get_by_ap_id(data["id"])
 581       assert "https://www.w3.org/ns/activitystreams#Public" in activity.recipients
 582     end
 583
 584     test "it accepts messages from actors that are followed by the user", %{
 585       conn: conn,
 586       data: data
 587     } do
 588       recipient = insert(:user)
 589       actor = insert(:user, %{ap_id: "http://mastodon.example.org/users/actor"})
 590
 591       {:ok, recipient} = User.follow(recipient, actor)
 592
 593       object =
 594         data["object"]
 595         |> Map.put("attributedTo", actor.ap_id)
 596
 597       data =
 598         data
 599         |> Map.put("actor", actor.ap_id)
 600         |> Map.put("object", object)
 601
 602       conn =
 603         conn
 604         |> assign(:valid_signature, true)
 605         |> put_req_header("content-type", "application/activity+json")
 606         |> post("/users/#{recipient.nickname}/inbox", data)
 607
 608       assert "ok" == json_response(conn, 200)
 609       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 610       assert Activity.get_by_ap_id(data["id"])
 611     end
 612
 613     test "it rejects reads from other users", %{conn: conn} do
 614       user = insert(:user)
 615       other_user = insert(:user)
 616
 617       conn =
 618         conn
 619         |> assign(:user, other_user)
 620         |> put_req_header("accept", "application/activity+json")
 621         |> get("/users/#{user.nickname}/inbox")
 622
 623       assert json_response(conn, 403)
 624     end
 625
 626     test "it returns a note activity in a collection", %{conn: conn} do
 627       note_activity = insert(:direct_note_activity)
 628       note_object = Object.normalize(note_activity)
 629       user = User.get_cached_by_ap_id(hd(note_activity.data["to"]))
 630
 631       conn =
 632         conn
 633         |> assign(:user, user)
 634         |> put_req_header("accept", "application/activity+json")
 635         |> get("/users/#{user.nickname}/inbox?page=true")
 636
 637       assert response(conn, 200) =~ note_object.data["content"]
 638     end
 639
 640     test "it clears `unreachable` federation status of the sender", %{conn: conn, data: data} do
 641       user = insert(:user)
 642       data = Map.put(data, "bcc", [user.ap_id])
 643
 644       sender_host = URI.parse(data["actor"]).host
 645       Instances.set_consistently_unreachable(sender_host)
 646       refute Instances.reachable?(sender_host)
 647
 648       conn =
 649         conn
 650         |> assign(:valid_signature, true)
 651         |> put_req_header("content-type", "application/activity+json")
 652         |> post("/users/#{user.nickname}/inbox", data)
 653
 654       assert "ok" == json_response(conn, 200)
 655       assert Instances.reachable?(sender_host)
 656     end
 657
 658     test "it removes all follower collections but actor's", %{conn: conn} do
 659       [actor, recipient] = insert_pair(:user)
 660
 661       data =
 662         File.read!("test/fixtures/activitypub-client-post-activity.json")
 663         |> Poison.decode!()
 664
 665       object = Map.put(data["object"], "attributedTo", actor.ap_id)
 666
 667       data =
 668         data
 669         |> Map.put("id", Utils.generate_object_id())
 670         |> Map.put("actor", actor.ap_id)
 671         |> Map.put("object", object)
 672         |> Map.put("cc", [
 673           recipient.follower_address,
 674           actor.follower_address
 675         ])
 676         |> Map.put("to", [
 677           recipient.ap_id,
 678           recipient.follower_address,
 679           "https://www.w3.org/ns/activitystreams#Public"
 680         ])
 681
 682       conn
 683       |> assign(:valid_signature, true)
 684       |> put_req_header("content-type", "application/activity+json")
 685       |> post("/users/#{recipient.nickname}/inbox", data)
 686       |> json_response(200)
 687
 688       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 689
 690       activity = Activity.get_by_ap_id(data["id"])
 691
 692       assert activity.id
 693       assert actor.follower_address in activity.recipients
 694       assert actor.follower_address in activity.data["cc"]
 695
 696       refute recipient.follower_address in activity.recipients
 697       refute recipient.follower_address in activity.data["cc"]
 698       refute recipient.follower_address in activity.data["to"]
 699     end
 700
 701     test "it requires authentication", %{conn: conn} do
 702       user = insert(:user)
 703       conn = put_req_header(conn, "accept", "application/activity+json")
 704
 705       ret_conn = get(conn, "/users/#{user.nickname}/inbox")
 706       assert json_response(ret_conn, 403)
 707
 708       ret_conn =
 709         conn
 710         |> assign(:user, user)
 711         |> get("/users/#{user.nickname}/inbox")
 712
 713       assert json_response(ret_conn, 200)
 714     end
 715   end
 716
 717   describe "GET /users/:nickname/outbox" do
 718     test "it returns 200 even if there're no activities", %{conn: conn} do
 719       user = insert(:user)
 720
 721       conn =
 722         conn
 723         |> assign(:user, user)
 724         |> put_req_header("accept", "application/activity+json")
 725         |> get("/users/#{user.nickname}/outbox")
 726
 727       result = json_response(conn, 200)
 728       assert user.ap_id <> "/outbox" == result["id"]
 729     end
 730
 731     test "it returns a note activity in a collection", %{conn: conn} do
 732       note_activity = insert(:note_activity)
 733       note_object = Object.normalize(note_activity)
 734       user = User.get_cached_by_ap_id(note_activity.data["actor"])
 735
 736       conn =
 737         conn
 738         |> assign(:user, user)
 739         |> put_req_header("accept", "application/activity+json")
 740         |> get("/users/#{user.nickname}/outbox?page=true")
 741
 742       assert response(conn, 200) =~ note_object.data["content"]
 743     end
 744
 745     test "it returns an announce activity in a collection", %{conn: conn} do
 746       announce_activity = insert(:announce_activity)
 747       user = User.get_cached_by_ap_id(announce_activity.data["actor"])
 748
 749       conn =
 750         conn
 751         |> assign(:user, user)
 752         |> put_req_header("accept", "application/activity+json")
 753         |> get("/users/#{user.nickname}/outbox?page=true")
 754
 755       assert response(conn, 200) =~ announce_activity.data["object"]
 756     end
 757
 758     test "it requires authentication if instance is NOT federating", %{
 759       conn: conn
 760     } do
 761       user = insert(:user)
 762       conn = put_req_header(conn, "accept", "application/activity+json")
 763
 764       ensure_federating_or_authenticated(conn, "/users/#{user.nickname}/outbox", user)
 765     end
 766   end
 767
 768   describe "POST /users/:nickname/outbox (C2S)" do
 769     setup do
 770       [
 771         activity: %{
 772           "@context" => "https://www.w3.org/ns/activitystreams",
 773           "type" => "Create",
 774           "object" => %{"type" => "Note", "content" => "AP C2S test"},
 775           "to" => "https://www.w3.org/ns/activitystreams#Public",
 776           "cc" => []
 777         }
 778       ]
 779     end
 780
 781     test "it rejects posts from other users / unauthenticated users", %{
 782       conn: conn,
 783       activity: activity
 784     } do
 785       user = insert(:user)
 786       other_user = insert(:user)
 787       conn = put_req_header(conn, "content-type", "application/activity+json")
 788
 789       conn
 790       |> post("/users/#{user.nickname}/outbox", activity)
 791       |> json_response(403)
 792
 793       conn
 794       |> assign(:user, other_user)
 795       |> post("/users/#{user.nickname}/outbox", activity)
 796       |> json_response(403)
 797     end
 798
 799     test "it inserts an incoming create activity into the database", %{
 800       conn: conn,
 801       activity: activity
 802     } do
 803       user = insert(:user)
 804
 805       result =
 806         conn
 807         |> assign(:user, user)
 808         |> put_req_header("content-type", "application/activity+json")
 809         |> post("/users/#{user.nickname}/outbox", activity)
 810         |> json_response(201)
 811
 812       assert Activity.get_by_ap_id(result["id"])
 813       assert result["object"]
 814       assert %Object{data: object} = Object.normalize(result["object"])
 815       assert object["content"] == activity["object"]["content"]
 816     end
 817
 818     test "it inserts an incoming sensitive activity into the database", %{
 819       conn: conn,
 820       activity: activity
 821     } do
 822       user = insert(:user)
 823       object = Map.put(activity["object"], "sensitive", true)
 824       activity = Map.put(activity, "object", object)
 825
 826       result =
 827         conn
 828         |> assign(:user, user)
 829         |> put_req_header("content-type", "application/activity+json")
 830         |> post("/users/#{user.nickname}/outbox", activity)
 831         |> json_response(201)
 832
 833       assert Activity.get_by_ap_id(result["id"])
 834       assert result["object"]
 835       assert %Object{data: object} = Object.normalize(result["object"])
 836       assert object["sensitive"] == activity["object"]["sensitive"]
 837       assert object["content"] == activity["object"]["content"]
 838     end
 839
 840     test "it rejects an incoming activity with bogus type", %{conn: conn, activity: activity} do
 841       user = insert(:user)
 842       activity = Map.put(activity, "type", "BadType")
 843
 844       conn =
 845         conn
 846         |> assign(:user, user)
 847         |> put_req_header("content-type", "application/activity+json")
 848         |> post("/users/#{user.nickname}/outbox", activity)
 849
 850       assert json_response(conn, 400)
 851     end
 852
 853     test "it erects a tombstone when receiving a delete activity", %{conn: conn} do
 854       note_activity = insert(:note_activity)
 855       note_object = Object.normalize(note_activity)
 856       user = User.get_cached_by_ap_id(note_activity.data["actor"])
 857
 858       data = %{
 859         type: "Delete",
 860         object: %{
 861           id: note_object.data["id"]
 862         }
 863       }
 864
 865       conn =
 866         conn
 867         |> assign(:user, user)
 868         |> put_req_header("content-type", "application/activity+json")
 869         |> post("/users/#{user.nickname}/outbox", data)
 870
 871       result = json_response(conn, 201)
 872       assert Activity.get_by_ap_id(result["id"])
 873
 874       assert object = Object.get_by_ap_id(note_object.data["id"])
 875       assert object.data["type"] == "Tombstone"
 876     end
 877
 878     test "it rejects delete activity of object from other actor", %{conn: conn} do
 879       note_activity = insert(:note_activity)
 880       note_object = Object.normalize(note_activity)
 881       user = insert(:user)
 882
 883       data = %{
 884         type: "Delete",
 885         object: %{
 886           id: note_object.data["id"]
 887         }
 888       }
 889
 890       conn =
 891         conn
 892         |> assign(:user, user)
 893         |> put_req_header("content-type", "application/activity+json")
 894         |> post("/users/#{user.nickname}/outbox", data)
 895
 896       assert json_response(conn, 400)
 897     end
 898
 899     test "it increases like count when receiving a like action", %{conn: conn} do
 900       note_activity = insert(:note_activity)
 901       note_object = Object.normalize(note_activity)
 902       user = User.get_cached_by_ap_id(note_activity.data["actor"])
 903
 904       data = %{
 905         type: "Like",
 906         object: %{
 907           id: note_object.data["id"]
 908         }
 909       }
 910
 911       conn =
 912         conn
 913         |> assign(:user, user)
 914         |> put_req_header("content-type", "application/activity+json")
 915         |> post("/users/#{user.nickname}/outbox", data)
 916
 917       result = json_response(conn, 201)
 918       assert Activity.get_by_ap_id(result["id"])
 919
 920       assert object = Object.get_by_ap_id(note_object.data["id"])
 921       assert object.data["like_count"] == 1
 922     end
 923   end
 924
 925   describe "/relay/followers" do
 926     test "it returns relay followers", %{conn: conn} do
 927       relay_actor = Relay.get_actor()
 928       user = insert(:user)
 929       User.follow(user, relay_actor)
 930
 931       result =
 932         conn
 933         |> get("/relay/followers")
 934         |> json_response(200)
 935
 936       assert result["first"]["orderedItems"] == [user.ap_id]
 937     end
 938
 939     test "on non-federating instance, it returns 404", %{conn: conn} do
 940       Config.put([:instance, :federating], false)
 941       user = insert(:user)
 942
 943       conn
 944       |> assign(:user, user)
 945       |> get("/relay/followers")
 946       |> json_response(404)
 947     end
 948   end
 949
 950   describe "/relay/following" do
 951     test "it returns relay following", %{conn: conn} do
 952       result =
 953         conn
 954         |> get("/relay/following")
 955         |> json_response(200)
 956
 957       assert result["first"]["orderedItems"] == []
 958     end
 959
 960     test "on non-federating instance, it returns 404", %{conn: conn} do
 961       Config.put([:instance, :federating], false)
 962       user = insert(:user)
 963
 964       conn
 965       |> assign(:user, user)
 966       |> get("/relay/following")
 967       |> json_response(404)
 968     end
 969   end
 970
 971   describe "/users/:nickname/followers" do
 972     test "it returns the followers in a collection", %{conn: conn} do
 973       user = insert(:user)
 974       user_two = insert(:user)
 975       User.follow(user, user_two)
 976
 977       result =
 978         conn
 979         |> assign(:user, user_two)
 980         |> get("/users/#{user_two.nickname}/followers")
 981         |> json_response(200)
 982
 983       assert result["first"]["orderedItems"] == [user.ap_id]
 984     end
 985
 986     test "it returns a uri if the user has 'hide_followers' set", %{conn: conn} do
 987       user = insert(:user)
 988       user_two = insert(:user, hide_followers: true)
 989       User.follow(user, user_two)
 990
 991       result =
 992         conn
 993         |> assign(:user, user)
 994         |> get("/users/#{user_two.nickname}/followers")
 995         |> json_response(200)
 996
 997       assert is_binary(result["first"])
 998     end
 999
1000     test "it returns a 403 error on pages, if the user has 'hide_followers' set and the request is from another user",
1001          %{conn: conn} do
1002       user = insert(:user)
1003       other_user = insert(:user, hide_followers: true)
1004
1005       result =
1006         conn
1007         |> assign(:user, user)
1008         |> get("/users/#{other_user.nickname}/followers?page=1")
1009
1010       assert result.status == 403
1011       assert result.resp_body == ""
1012     end
1013
1014     test "it renders the page, if the user has 'hide_followers' set and the request is authenticated with the same user",
1015          %{conn: conn} do
1016       user = insert(:user, hide_followers: true)
1017       other_user = insert(:user)
1018       {:ok, _other_user, user, _activity} = CommonAPI.follow(other_user, user)
1019
1020       result =
1021         conn
1022         |> assign(:user, user)
1023         |> get("/users/#{user.nickname}/followers?page=1")
1024         |> json_response(200)
1025
1026       assert result["totalItems"] == 1
1027       assert result["orderedItems"] == [other_user.ap_id]
1028     end
1029
1030     test "it works for more than 10 users", %{conn: conn} do
1031       user = insert(:user)
1032
1033       Enum.each(1..15, fn _ ->
1034         other_user = insert(:user)
1035         User.follow(other_user, user)
1036       end)
1037
1038       result =
1039         conn
1040         |> assign(:user, user)
1041         |> get("/users/#{user.nickname}/followers")
1042         |> json_response(200)
1043
1044       assert length(result["first"]["orderedItems"]) == 10
1045       assert result["first"]["totalItems"] == 15
1046       assert result["totalItems"] == 15
1047
1048       result =
1049         conn
1050         |> assign(:user, user)
1051         |> get("/users/#{user.nickname}/followers?page=2")
1052         |> json_response(200)
1053
1054       assert length(result["orderedItems"]) == 5
1055       assert result["totalItems"] == 15
1056     end
1057
1058     test "does not require authentication", %{conn: conn} do
1059       user = insert(:user)
1060
1061       conn
1062       |> get("/users/#{user.nickname}/followers")
1063       |> json_response(200)
1064     end
1065   end
1066
1067   describe "/users/:nickname/following" do
1068     test "it returns the following in a collection", %{conn: conn} do
1069       user = insert(:user)
1070       user_two = insert(:user)
1071       User.follow(user, user_two)
1072
1073       result =
1074         conn
1075         |> assign(:user, user)
1076         |> get("/users/#{user.nickname}/following")
1077         |> json_response(200)
1078
1079       assert result["first"]["orderedItems"] == [user_two.ap_id]
1080     end
1081
1082     test "it returns a uri if the user has 'hide_follows' set", %{conn: conn} do
1083       user = insert(:user)
1084       user_two = insert(:user, hide_follows: true)
1085       User.follow(user, user_two)
1086
1087       result =
1088         conn
1089         |> assign(:user, user)
1090         |> get("/users/#{user_two.nickname}/following")
1091         |> json_response(200)
1092
1093       assert is_binary(result["first"])
1094     end
1095
1096     test "it returns a 403 error on pages, if the user has 'hide_follows' set and the request is from another user",
1097          %{conn: conn} do
1098       user = insert(:user)
1099       user_two = insert(:user, hide_follows: true)
1100
1101       result =
1102         conn
1103         |> assign(:user, user)
1104         |> get("/users/#{user_two.nickname}/following?page=1")
1105
1106       assert result.status == 403
1107       assert result.resp_body == ""
1108     end
1109
1110     test "it renders the page, if the user has 'hide_follows' set and the request is authenticated with the same user",
1111          %{conn: conn} do
1112       user = insert(:user, hide_follows: true)
1113       other_user = insert(:user)
1114       {:ok, user, _other_user, _activity} = CommonAPI.follow(user, other_user)
1115
1116       result =
1117         conn
1118         |> assign(:user, user)
1119         |> get("/users/#{user.nickname}/following?page=1")
1120         |> json_response(200)
1121
1122       assert result["totalItems"] == 1
1123       assert result["orderedItems"] == [other_user.ap_id]
1124     end
1125
1126     test "it works for more than 10 users", %{conn: conn} do
1127       user = insert(:user)
1128
1129       Enum.each(1..15, fn _ ->
1130         user = User.get_cached_by_id(user.id)
1131         other_user = insert(:user)
1132         User.follow(user, other_user)
1133       end)
1134
1135       result =
1136         conn
1137         |> assign(:user, user)
1138         |> get("/users/#{user.nickname}/following")
1139         |> json_response(200)
1140
1141       assert length(result["first"]["orderedItems"]) == 10
1142       assert result["first"]["totalItems"] == 15
1143       assert result["totalItems"] == 15
1144
1145       result =
1146         conn
1147         |> assign(:user, user)
1148         |> get("/users/#{user.nickname}/following?page=2")
1149         |> json_response(200)
1150
1151       assert length(result["orderedItems"]) == 5
1152       assert result["totalItems"] == 15
1153     end
1154
1155     test "does not require authentication", %{conn: conn} do
1156       user = insert(:user)
1157
1158       conn
1159       |> get("/users/#{user.nickname}/following")
1160       |> json_response(200)
1161     end
1162   end
1163
1164   describe "delivery tracking" do
1165     test "it tracks a signed object fetch", %{conn: conn} do
1166       user = insert(:user, local: false)
1167       activity = insert(:note_activity)
1168       object = Object.normalize(activity)
1169
1170       object_path = String.trim_leading(object.data["id"], Pleroma.Web.Endpoint.url())
1171
1172       conn
1173       |> put_req_header("accept", "application/activity+json")
1174       |> assign(:user, user)
1175       |> get(object_path)
1176       |> json_response(200)
1177
1178       assert Delivery.get(object.id, user.id)
1179     end
1180
1181     test "it tracks a signed activity fetch", %{conn: conn} do
1182       user = insert(:user, local: false)
1183       activity = insert(:note_activity)
1184       object = Object.normalize(activity)
1185
1186       activity_path = String.trim_leading(activity.data["id"], Pleroma.Web.Endpoint.url())
1187
1188       conn
1189       |> put_req_header("accept", "application/activity+json")
1190       |> assign(:user, user)
1191       |> get(activity_path)
1192       |> json_response(200)
1193
1194       assert Delivery.get(object.id, user.id)
1195     end
1196
1197     test "it tracks a signed object fetch when the json is cached", %{conn: conn} do
1198       user = insert(:user, local: false)
1199       other_user = insert(:user, local: false)
1200       activity = insert(:note_activity)
1201       object = Object.normalize(activity)
1202
1203       object_path = String.trim_leading(object.data["id"], Pleroma.Web.Endpoint.url())
1204
1205       conn
1206       |> put_req_header("accept", "application/activity+json")
1207       |> assign(:user, user)
1208       |> get(object_path)
1209       |> json_response(200)
1210
1211       build_conn()
1212       |> put_req_header("accept", "application/activity+json")
1213       |> assign(:user, other_user)
1214       |> get(object_path)
1215       |> json_response(200)
1216
1217       assert Delivery.get(object.id, user.id)
1218       assert Delivery.get(object.id, other_user.id)
1219     end
1220
1221     test "it tracks a signed activity fetch when the json is cached", %{conn: conn} do
1222       user = insert(:user, local: false)
1223       other_user = insert(:user, local: false)
1224       activity = insert(:note_activity)
1225       object = Object.normalize(activity)
1226
1227       activity_path = String.trim_leading(activity.data["id"], Pleroma.Web.Endpoint.url())
1228
1229       conn
1230       |> put_req_header("accept", "application/activity+json")
1231       |> assign(:user, user)
1232       |> get(activity_path)
1233       |> json_response(200)
1234
1235       build_conn()
1236       |> put_req_header("accept", "application/activity+json")
1237       |> assign(:user, other_user)
1238       |> get(activity_path)
1239       |> json_response(200)
1240
1241       assert Delivery.get(object.id, user.id)
1242       assert Delivery.get(object.id, other_user.id)
1243     end
1244   end
1245
1246   describe "Additional ActivityPub C2S endpoints" do
1247     test "GET /api/ap/whoami", %{conn: conn} do
1248       user = insert(:user)
1249
1250       conn =
1251         conn
1252         |> assign(:user, user)
1253         |> get("/api/ap/whoami")
1254
1255       user = User.get_cached_by_id(user.id)
1256
1257       assert UserView.render("user.json", %{user: user}) == json_response(conn, 200)
1258
1259       conn
1260       |> get("/api/ap/whoami")
1261       |> json_response(403)
1262     end
1263
1264     setup do: clear_config([:media_proxy])
1265     setup do: clear_config([Pleroma.Upload])
1266
1267     test "POST /api/ap/upload_media", %{conn: conn} do
1268       user = insert(:user)
1269
1270       desc = "Description of the image"
1271
1272       image = %Plug.Upload{
1273         content_type: "image/jpg",
1274         path: Path.absname("test/fixtures/image.jpg"),
1275         filename: "an_image.jpg"
1276       }
1277
1278       object =
1279         conn
1280         |> assign(:user, user)
1281         |> post("/api/ap/upload_media", %{"file" => image, "description" => desc})
1282         |> json_response(:created)
1283
1284       assert object["name"] == desc
1285       assert object["type"] == "Document"
1286       assert object["actor"] == user.ap_id
1287       assert [%{"href" => object_href, "mediaType" => object_mediatype}] = object["url"]
1288       assert is_binary(object_href)
1289       assert object_mediatype == "image/jpeg"
1290
1291       activity_request = %{
1292         "@context" => "https://www.w3.org/ns/activitystreams",
1293         "type" => "Create",
1294         "object" => %{
1295           "type" => "Note",
1296           "content" => "AP C2S test, attachment",
1297           "attachment" => [object]
1298         },
1299         "to" => "https://www.w3.org/ns/activitystreams#Public",
1300         "cc" => []
1301       }
1302
1303       activity_response =
1304         conn
1305         |> assign(:user, user)
1306         |> post("/users/#{user.nickname}/outbox", activity_request)
1307         |> json_response(:created)
1308
1309       assert activity_response["id"]
1310       assert activity_response["object"]
1311       assert activity_response["actor"] == user.ap_id
1312
1313       assert %Object{data: %{"attachment" => [attachment]}} =
1314                Object.normalize(activity_response["object"])
1315
1316       assert attachment["type"] == "Document"
1317       assert attachment["name"] == desc
1318
1319       assert [
1320                %{
1321                  "href" => ^object_href,
1322                  "type" => "Link",
1323                  "mediaType" => ^object_mediatype
1324                }
1325              ] = attachment["url"]
1326
1327       # Fails if unauthenticated
1328       conn
1329       |> post("/api/ap/upload_media", %{"file" => image, "description" => desc})
1330       |> json_response(403)
1331     end
1332   end
1333 end