1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Web.MastodonAPI.AccountControllerTest do
6 use Pleroma.Web.ConnCase
10 alias Pleroma.Web.ActivityPub.ActivityPub
11 alias Pleroma.Web.ActivityPub.InternalFetchActor
12 alias Pleroma.Web.CommonAPI
13 alias Pleroma.Web.OAuth.Token
15 import Pleroma.Factory
17 describe "account fetching" do
18 clear_config([:instance, :limit_to_local_content])
25 |> get("/api/v1/accounts/#{user.id}")
27 assert %{"id" => id} = json_response(conn, 200)
28 assert id == to_string(user.id)
32 |> get("/api/v1/accounts/-1")
34 assert %{"error" => "Can't find user"} = json_response(conn, 404)
37 test "works by nickname" do
42 |> get("/api/v1/accounts/#{user.nickname}")
44 assert %{"id" => id} = json_response(conn, 200)
48 test "works by nickname for remote users" do
49 Pleroma.Config.put([:instance, :limit_to_local_content], false)
50 user = insert(:user, nickname: "user@example.com", local: false)
54 |> get("/api/v1/accounts/#{user.nickname}")
56 assert %{"id" => id} = json_response(conn, 200)
60 test "respects limit_to_local_content == :all for remote user nicknames" do
61 Pleroma.Config.put([:instance, :limit_to_local_content], :all)
63 user = insert(:user, nickname: "user@example.com", local: false)
67 |> get("/api/v1/accounts/#{user.nickname}")
69 assert json_response(conn, 404)
72 test "respects limit_to_local_content == :unauthenticated for remote user nicknames" do
73 Pleroma.Config.put([:instance, :limit_to_local_content], :unauthenticated)
75 user = insert(:user, nickname: "user@example.com", local: false)
76 reading_user = insert(:user)
80 |> get("/api/v1/accounts/#{user.nickname}")
82 assert json_response(conn, 404)
86 |> assign(:user, reading_user)
87 |> assign(:token, insert(:oauth_token, user: reading_user, scopes: ["read:accounts"]))
88 |> get("/api/v1/accounts/#{user.nickname}")
90 assert %{"id" => id} = json_response(conn, 200)
94 test "accounts fetches correct account for nicknames beginning with numbers", %{conn: conn} do
95 # Need to set an old-style integer ID to reproduce the problem
96 # (these are no longer assigned to new accounts but were preserved
97 # for existing accounts during the migration to flakeIDs)
98 user_one = insert(:user, %{id: 1212})
99 user_two = insert(:user, %{nickname: "#{user_one.id}garbage"})
103 |> get("/api/v1/accounts/#{user_one.id}")
107 |> get("/api/v1/accounts/#{user_two.nickname}")
111 |> get("/api/v1/accounts/#{user_two.id}")
113 acc_one = json_response(resp_one, 200)
114 acc_two = json_response(resp_two, 200)
115 acc_three = json_response(resp_three, 200)
116 refute acc_one == acc_two
117 assert acc_two == acc_three
120 test "returns 404 when user is invisible", %{conn: conn} do
121 user = insert(:user, %{invisible: true})
125 |> get("/api/v1/accounts/#{user.nickname}")
126 |> json_response(404)
128 assert %{"error" => "Can't find user"} = resp
131 test "returns 404 for internal.fetch actor", %{conn: conn} do
132 %User{nickname: "internal.fetch"} = InternalFetchActor.get_actor()
136 |> get("/api/v1/accounts/internal.fetch")
137 |> json_response(404)
139 assert %{"error" => "Can't find user"} = resp
143 describe "user timelines" do
144 setup do: oauth_access(["read:statuses"])
146 test "respects blocks", %{user: user_one, conn: conn} do
147 user_two = insert(:user)
148 user_three = insert(:user)
150 User.block(user_one, user_two)
152 {:ok, activity} = CommonAPI.post(user_two, %{"status" => "User one sux0rz"})
153 {:ok, repeat, _} = CommonAPI.repeat(activity.id, user_three)
155 resp = get(conn, "/api/v1/accounts/#{user_two.id}/statuses")
157 assert [%{"id" => id}] = json_response(resp, 200)
158 assert id == activity.id
160 # Even a blocked user will deliver the full user timeline, there would be
161 # no point in looking at a blocked users timeline otherwise
162 resp = get(conn, "/api/v1/accounts/#{user_two.id}/statuses")
164 assert [%{"id" => id}] = json_response(resp, 200)
165 assert id == activity.id
167 # Third user's timeline includes the repeat when viewed by unauthenticated user
168 resp = get(build_conn(), "/api/v1/accounts/#{user_three.id}/statuses")
169 assert [%{"id" => id}] = json_response(resp, 200)
170 assert id == repeat.id
172 # When viewing a third user's timeline, the blocked users' statuses will NOT be shown
173 resp = get(conn, "/api/v1/accounts/#{user_three.id}/statuses")
175 assert [] = json_response(resp, 200)
178 test "gets users statuses", %{conn: conn} do
179 user_one = insert(:user)
180 user_two = insert(:user)
181 user_three = insert(:user)
183 {:ok, _user_three} = User.follow(user_three, user_one)
185 {:ok, activity} = CommonAPI.post(user_one, %{"status" => "HI!!!"})
187 {:ok, direct_activity} =
188 CommonAPI.post(user_one, %{
189 "status" => "Hi, @#{user_two.nickname}.",
190 "visibility" => "direct"
193 {:ok, private_activity} =
194 CommonAPI.post(user_one, %{"status" => "private", "visibility" => "private"})
196 resp = get(conn, "/api/v1/accounts/#{user_one.id}/statuses")
198 assert [%{"id" => id}] = json_response(resp, 200)
199 assert id == to_string(activity.id)
203 |> assign(:user, user_two)
204 |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
205 |> get("/api/v1/accounts/#{user_one.id}/statuses")
207 assert [%{"id" => id_one}, %{"id" => id_two}] = json_response(resp, 200)
208 assert id_one == to_string(direct_activity.id)
209 assert id_two == to_string(activity.id)
213 |> assign(:user, user_three)
214 |> assign(:token, insert(:oauth_token, user: user_three, scopes: ["read:statuses"]))
215 |> get("/api/v1/accounts/#{user_one.id}/statuses")
217 assert [%{"id" => id_one}, %{"id" => id_two}] = json_response(resp, 200)
218 assert id_one == to_string(private_activity.id)
219 assert id_two == to_string(activity.id)
222 test "unimplemented pinned statuses feature", %{conn: conn} do
223 note = insert(:note_activity)
224 user = User.get_cached_by_ap_id(note.data["actor"])
226 conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?pinned=true")
228 assert json_response(conn, 200) == []
231 test "gets an users media", %{conn: conn} do
232 note = insert(:note_activity)
233 user = User.get_cached_by_ap_id(note.data["actor"])
236 content_type: "image/jpg",
237 path: Path.absname("test/fixtures/image.jpg"),
238 filename: "an_image.jpg"
241 {:ok, %{id: media_id}} = ActivityPub.upload(file, actor: user.ap_id)
243 {:ok, image_post} = CommonAPI.post(user, %{"status" => "cofe", "media_ids" => [media_id]})
245 conn = get(conn, "/api/v1/accounts/#{user.id}/statuses", %{"only_media" => "true"})
247 assert [%{"id" => id}] = json_response(conn, 200)
248 assert id == to_string(image_post.id)
250 conn = get(build_conn(), "/api/v1/accounts/#{user.id}/statuses", %{"only_media" => "1"})
252 assert [%{"id" => id}] = json_response(conn, 200)
253 assert id == to_string(image_post.id)
256 test "gets a user's statuses without reblogs", %{user: user, conn: conn} do
257 {:ok, post} = CommonAPI.post(user, %{"status" => "HI!!!"})
258 {:ok, _, _} = CommonAPI.repeat(post.id, user)
260 conn = get(conn, "/api/v1/accounts/#{user.id}/statuses", %{"exclude_reblogs" => "true"})
262 assert [%{"id" => id}] = json_response(conn, 200)
263 assert id == to_string(post.id)
265 conn = get(conn, "/api/v1/accounts/#{user.id}/statuses", %{"exclude_reblogs" => "1"})
267 assert [%{"id" => id}] = json_response(conn, 200)
268 assert id == to_string(post.id)
271 test "filters user's statuses by a hashtag", %{user: user, conn: conn} do
272 {:ok, post} = CommonAPI.post(user, %{"status" => "#hashtag"})
273 {:ok, _post} = CommonAPI.post(user, %{"status" => "hashtag"})
275 conn = get(conn, "/api/v1/accounts/#{user.id}/statuses", %{"tagged" => "hashtag"})
277 assert [%{"id" => id}] = json_response(conn, 200)
278 assert id == to_string(post.id)
281 test "the user views their own timelines and excludes direct messages", %{
285 {:ok, public_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "public"})
286 {:ok, _direct_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "direct"})
289 get(conn, "/api/v1/accounts/#{user.id}/statuses", %{"exclude_visibilities" => ["direct"]})
291 assert [%{"id" => id}] = json_response(conn, 200)
292 assert id == to_string(public_activity.id)
296 describe "followers" do
297 setup do: oauth_access(["read:accounts"])
299 test "getting followers", %{user: user, conn: conn} do
300 other_user = insert(:user)
301 {:ok, user} = User.follow(user, other_user)
303 conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")
305 assert [%{"id" => id}] = json_response(conn, 200)
306 assert id == to_string(user.id)
309 test "getting followers, hide_followers", %{user: user, conn: conn} do
310 other_user = insert(:user, hide_followers: true)
311 {:ok, _user} = User.follow(user, other_user)
313 conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")
315 assert [] == json_response(conn, 200)
318 test "getting followers, hide_followers, same user requesting" do
320 other_user = insert(:user, hide_followers: true)
321 {:ok, _user} = User.follow(user, other_user)
325 |> assign(:user, other_user)
326 |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
327 |> get("/api/v1/accounts/#{other_user.id}/followers")
329 refute [] == json_response(conn, 200)
332 test "getting followers, pagination", %{user: user, conn: conn} do
333 follower1 = insert(:user)
334 follower2 = insert(:user)
335 follower3 = insert(:user)
336 {:ok, _} = User.follow(follower1, user)
337 {:ok, _} = User.follow(follower2, user)
338 {:ok, _} = User.follow(follower3, user)
340 res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?since_id=#{follower1.id}")
342 assert [%{"id" => id3}, %{"id" => id2}] = json_response(res_conn, 200)
343 assert id3 == follower3.id
344 assert id2 == follower2.id
346 res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?max_id=#{follower3.id}")
348 assert [%{"id" => id2}, %{"id" => id1}] = json_response(res_conn, 200)
349 assert id2 == follower2.id
350 assert id1 == follower1.id
352 res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?limit=1&max_id=#{follower3.id}")
354 assert [%{"id" => id2}] = json_response(res_conn, 200)
355 assert id2 == follower2.id
357 assert [link_header] = get_resp_header(res_conn, "link")
358 assert link_header =~ ~r/min_id=#{follower2.id}/
359 assert link_header =~ ~r/max_id=#{follower2.id}/
363 describe "following" do
364 setup do: oauth_access(["read:accounts"])
366 test "getting following", %{user: user, conn: conn} do
367 other_user = insert(:user)
368 {:ok, user} = User.follow(user, other_user)
370 conn = get(conn, "/api/v1/accounts/#{user.id}/following")
372 assert [%{"id" => id}] = json_response(conn, 200)
373 assert id == to_string(other_user.id)
376 test "getting following, hide_follows, other user requesting" do
377 user = insert(:user, hide_follows: true)
378 other_user = insert(:user)
379 {:ok, user} = User.follow(user, other_user)
383 |> assign(:user, other_user)
384 |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
385 |> get("/api/v1/accounts/#{user.id}/following")
387 assert [] == json_response(conn, 200)
390 test "getting following, hide_follows, same user requesting" do
391 user = insert(:user, hide_follows: true)
392 other_user = insert(:user)
393 {:ok, user} = User.follow(user, other_user)
397 |> assign(:user, user)
398 |> assign(:token, insert(:oauth_token, user: user, scopes: ["read:accounts"]))
399 |> get("/api/v1/accounts/#{user.id}/following")
401 refute [] == json_response(conn, 200)
404 test "getting following, pagination", %{user: user, conn: conn} do
405 following1 = insert(:user)
406 following2 = insert(:user)
407 following3 = insert(:user)
408 {:ok, _} = User.follow(user, following1)
409 {:ok, _} = User.follow(user, following2)
410 {:ok, _} = User.follow(user, following3)
412 res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?since_id=#{following1.id}")
414 assert [%{"id" => id3}, %{"id" => id2}] = json_response(res_conn, 200)
415 assert id3 == following3.id
416 assert id2 == following2.id
418 res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?max_id=#{following3.id}")
420 assert [%{"id" => id2}, %{"id" => id1}] = json_response(res_conn, 200)
421 assert id2 == following2.id
422 assert id1 == following1.id
425 get(conn, "/api/v1/accounts/#{user.id}/following?limit=1&max_id=#{following3.id}")
427 assert [%{"id" => id2}] = json_response(res_conn, 200)
428 assert id2 == following2.id
430 assert [link_header] = get_resp_header(res_conn, "link")
431 assert link_header =~ ~r/min_id=#{following2.id}/
432 assert link_header =~ ~r/max_id=#{following2.id}/
436 describe "follow/unfollow" do
437 setup do: oauth_access(["follow"])
439 test "following / unfollowing a user", %{conn: conn} do
440 other_user = insert(:user)
442 ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/follow")
444 assert %{"id" => _id, "following" => true} = json_response(ret_conn, 200)
446 ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/unfollow")
448 assert %{"id" => _id, "following" => false} = json_response(ret_conn, 200)
450 conn = post(conn, "/api/v1/follows", %{"uri" => other_user.nickname})
452 assert %{"id" => id} = json_response(conn, 200)
453 assert id == to_string(other_user.id)
456 test "cancelling follow request", %{conn: conn} do
457 %{id: other_user_id} = insert(:user, %{locked: true})
459 assert %{"id" => ^other_user_id, "following" => false, "requested" => true} =
460 conn |> post("/api/v1/accounts/#{other_user_id}/follow") |> json_response(:ok)
462 assert %{"id" => ^other_user_id, "following" => false, "requested" => false} =
463 conn |> post("/api/v1/accounts/#{other_user_id}/unfollow") |> json_response(:ok)
466 test "following without reblogs" do
467 %{conn: conn} = oauth_access(["follow", "read:statuses"])
468 followed = insert(:user)
469 other_user = insert(:user)
471 ret_conn = post(conn, "/api/v1/accounts/#{followed.id}/follow?reblogs=false")
473 assert %{"showing_reblogs" => false} = json_response(ret_conn, 200)
475 {:ok, activity} = CommonAPI.post(other_user, %{"status" => "hey"})
476 {:ok, reblog, _} = CommonAPI.repeat(activity.id, followed)
478 ret_conn = get(conn, "/api/v1/timelines/home")
480 assert [] == json_response(ret_conn, 200)
482 ret_conn = post(conn, "/api/v1/accounts/#{followed.id}/follow?reblogs=true")
484 assert %{"showing_reblogs" => true} = json_response(ret_conn, 200)
486 conn = get(conn, "/api/v1/timelines/home")
488 expected_activity_id = reblog.id
489 assert [%{"id" => ^expected_activity_id}] = json_response(conn, 200)
492 test "following / unfollowing errors", %{user: user, conn: conn} do
494 conn_res = post(conn, "/api/v1/accounts/#{user.id}/follow")
495 assert %{"error" => "Record not found"} = json_response(conn_res, 404)
498 user = User.get_cached_by_id(user.id)
499 conn_res = post(conn, "/api/v1/accounts/#{user.id}/unfollow")
500 assert %{"error" => "Record not found"} = json_response(conn_res, 404)
502 # self follow via uri
503 user = User.get_cached_by_id(user.id)
504 conn_res = post(conn, "/api/v1/follows", %{"uri" => user.nickname})
505 assert %{"error" => "Record not found"} = json_response(conn_res, 404)
507 # follow non existing user
508 conn_res = post(conn, "/api/v1/accounts/doesntexist/follow")
509 assert %{"error" => "Record not found"} = json_response(conn_res, 404)
511 # follow non existing user via uri
512 conn_res = post(conn, "/api/v1/follows", %{"uri" => "doesntexist"})
513 assert %{"error" => "Record not found"} = json_response(conn_res, 404)
515 # unfollow non existing user
516 conn_res = post(conn, "/api/v1/accounts/doesntexist/unfollow")
517 assert %{"error" => "Record not found"} = json_response(conn_res, 404)
521 describe "mute/unmute" do
522 setup do: oauth_access(["write:mutes"])
524 test "with notifications", %{conn: conn} do
525 other_user = insert(:user)
527 ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/mute")
529 response = json_response(ret_conn, 200)
531 assert %{"id" => _id, "muting" => true, "muting_notifications" => true} = response
533 conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")
535 response = json_response(conn, 200)
536 assert %{"id" => _id, "muting" => false, "muting_notifications" => false} = response
539 test "without notifications", %{conn: conn} do
540 other_user = insert(:user)
543 post(conn, "/api/v1/accounts/#{other_user.id}/mute", %{"notifications" => "false"})
545 response = json_response(ret_conn, 200)
547 assert %{"id" => _id, "muting" => true, "muting_notifications" => false} = response
549 conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")
551 response = json_response(conn, 200)
552 assert %{"id" => _id, "muting" => false, "muting_notifications" => false} = response
556 describe "pinned statuses" do
559 {:ok, activity} = CommonAPI.post(user, %{"status" => "HI!!!"})
560 %{conn: conn} = oauth_access(["read:statuses"], user: user)
562 [conn: conn, user: user, activity: activity]
565 test "returns pinned statuses", %{conn: conn, user: user, activity: activity} do
566 {:ok, _} = CommonAPI.pin(activity.id, user)
570 |> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
571 |> json_response(200)
573 id_str = to_string(activity.id)
575 assert [%{"id" => ^id_str, "pinned" => true}] = result
579 test "blocking / unblocking a user" do
580 %{conn: conn} = oauth_access(["follow"])
581 other_user = insert(:user)
583 ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/block")
585 assert %{"id" => _id, "blocking" => true} = json_response(ret_conn, 200)
587 conn = post(conn, "/api/v1/accounts/#{other_user.id}/unblock")
589 assert %{"id" => _id, "blocking" => false} = json_response(conn, 200)
592 describe "create account by app" do
596 email: "lain@example.org",
597 password: "PlzDontHackLain",
601 [valid_params: valid_params]
604 test "Account registration via Application", %{conn: conn} do
606 post(conn, "/api/v1/apps", %{
607 client_name: "client_name",
608 redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
609 scopes: "read, write, follow"
613 "client_id" => client_id,
614 "client_secret" => client_secret,
616 "name" => "client_name",
617 "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
620 } = json_response(conn, 200)
623 post(conn, "/oauth/token", %{
624 grant_type: "client_credentials",
625 client_id: client_id,
626 client_secret: client_secret
629 assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
630 json_response(conn, 200)
633 token_from_db = Repo.get_by(Token, token: token)
636 assert scope == "read write follow"
640 |> put_req_header("authorization", "Bearer " <> token)
641 |> post("/api/v1/accounts", %{
643 email: "lain@example.org",
644 password: "PlzDontHackLain",
650 "access_token" => token,
651 "created_at" => _created_at,
653 "token_type" => "Bearer"
654 } = json_response(conn, 200)
656 token_from_db = Repo.get_by(Token, token: token)
658 token_from_db = Repo.preload(token_from_db, :user)
659 assert token_from_db.user
661 assert token_from_db.user.confirmation_pending
664 test "returns error when user already registred", %{conn: conn, valid_params: valid_params} do
665 _user = insert(:user, email: "lain@example.org")
666 app_token = insert(:oauth_token, user: nil)
670 |> put_req_header("authorization", "Bearer " <> app_token.token)
672 res = post(conn, "/api/v1/accounts", valid_params)
673 assert json_response(res, 400) == %{"error" => "{\"email\":[\"has already been taken\"]}"}
676 test "returns bad_request if missing required params", %{
678 valid_params: valid_params
680 app_token = insert(:oauth_token, user: nil)
682 conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
684 res = post(conn, "/api/v1/accounts", valid_params)
685 assert json_response(res, 200)
687 [{127, 0, 0, 1}, {127, 0, 0, 2}, {127, 0, 0, 3}, {127, 0, 0, 4}]
688 |> Stream.zip(valid_params)
689 |> Enum.each(fn {ip, {attr, _}} ->
692 |> Map.put(:remote_ip, ip)
693 |> post("/api/v1/accounts", Map.delete(valid_params, attr))
694 |> json_response(400)
696 assert res == %{"error" => "Missing parameters"}
700 test "returns forbidden if token is invalid", %{conn: conn, valid_params: valid_params} do
701 conn = put_req_header(conn, "authorization", "Bearer " <> "invalid-token")
703 res = post(conn, "/api/v1/accounts", valid_params)
704 assert json_response(res, 403) == %{"error" => "Invalid credentials"}
708 describe "create account by app / rate limit" do
709 clear_config([Pleroma.Plugs.RemoteIp, :enabled]) do
710 Pleroma.Config.put([Pleroma.Plugs.RemoteIp, :enabled], true)
713 clear_config([:rate_limit, :app_account_creation]) do
714 Pleroma.Config.put([:rate_limit, :app_account_creation], {10_000, 2})
717 test "respects rate limit setting", %{conn: conn} do
718 app_token = insert(:oauth_token, user: nil)
722 |> put_req_header("authorization", "Bearer " <> app_token.token)
723 |> Map.put(:remote_ip, {15, 15, 15, 15})
727 post(conn, "/api/v1/accounts", %{
728 username: "#{i}lain",
729 email: "#{i}lain@example.org",
730 password: "PlzDontHackLain",
735 "access_token" => token,
736 "created_at" => _created_at,
738 "token_type" => "Bearer"
739 } = json_response(conn, 200)
741 token_from_db = Repo.get_by(Token, token: token)
743 token_from_db = Repo.preload(token_from_db, :user)
744 assert token_from_db.user
746 assert token_from_db.user.confirmation_pending
750 post(conn, "/api/v1/accounts", %{
752 email: "6lain@example.org",
753 password: "PlzDontHackLain",
757 assert json_response(conn, :too_many_requests) == %{"error" => "Throttled"}
761 describe "GET /api/v1/accounts/:id/lists - account_lists" do
762 test "returns lists to which the account belongs" do
763 %{user: user, conn: conn} = oauth_access(["read:lists"])
764 other_user = insert(:user)
765 assert {:ok, %Pleroma.List{} = list} = Pleroma.List.create("Test List", user)
766 {:ok, %{following: _following}} = Pleroma.List.follow(list, other_user)
770 |> get("/api/v1/accounts/#{other_user.id}/lists")
771 |> json_response(200)
773 assert res == [%{"id" => to_string(list.id), "title" => "Test List"}]
777 describe "verify_credentials" do
778 test "verify_credentials" do
779 %{user: user, conn: conn} = oauth_access(["read:accounts"])
780 conn = get(conn, "/api/v1/accounts/verify_credentials")
782 response = json_response(conn, 200)
784 assert %{"id" => id, "source" => %{"privacy" => "public"}} = response
785 assert response["pleroma"]["chat_token"]
786 assert id == to_string(user.id)
789 test "verify_credentials default scope unlisted" do
790 user = insert(:user, default_scope: "unlisted")
791 %{conn: conn} = oauth_access(["read:accounts"], user: user)
793 conn = get(conn, "/api/v1/accounts/verify_credentials")
795 assert %{"id" => id, "source" => %{"privacy" => "unlisted"}} = json_response(conn, 200)
796 assert id == to_string(user.id)
799 test "locked accounts" do
800 user = insert(:user, default_scope: "private")
801 %{conn: conn} = oauth_access(["read:accounts"], user: user)
803 conn = get(conn, "/api/v1/accounts/verify_credentials")
805 assert %{"id" => id, "source" => %{"privacy" => "private"}} = json_response(conn, 200)
806 assert id == to_string(user.id)
810 describe "user relationships" do
811 setup do: oauth_access(["read:follows"])
813 test "returns the relationships for the current user", %{user: user, conn: conn} do
814 other_user = insert(:user)
815 {:ok, _user} = User.follow(user, other_user)
817 conn = get(conn, "/api/v1/accounts/relationships", %{"id" => [other_user.id]})
819 assert [relationship] = json_response(conn, 200)
821 assert to_string(other_user.id) == relationship["id"]
824 test "returns an empty list on a bad request", %{conn: conn} do
825 conn = get(conn, "/api/v1/accounts/relationships", %{})
827 assert [] = json_response(conn, 200)
831 test "getting a list of mutes" do
832 %{user: user, conn: conn} = oauth_access(["read:mutes"])
833 other_user = insert(:user)
835 {:ok, _user_relationships} = User.mute(user, other_user)
837 conn = get(conn, "/api/v1/mutes")
839 other_user_id = to_string(other_user.id)
840 assert [%{"id" => ^other_user_id}] = json_response(conn, 200)
843 test "getting a list of blocks" do
844 %{user: user, conn: conn} = oauth_access(["read:blocks"])
845 other_user = insert(:user)
847 {:ok, _user_relationship} = User.block(user, other_user)
851 |> assign(:user, user)
852 |> get("/api/v1/blocks")
854 other_user_id = to_string(other_user.id)
855 assert [%{"id" => ^other_user_id}] = json_response(conn, 200)