git.squeep.com Git - akkoma/blob - test/web/mastodon_api/controllers/account_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.AccountControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   alias Pleroma.Config
   9   alias Pleroma.Repo
  10   alias Pleroma.User
  11   alias Pleroma.Web.ActivityPub.ActivityPub
  12   alias Pleroma.Web.ActivityPub.InternalFetchActor
  13   alias Pleroma.Web.CommonAPI
  14   alias Pleroma.Web.OAuth.Token
  15
  16   import Pleroma.Factory
  17
  18   describe "account fetching" do
  19     setup do: clear_config([:instance, :limit_to_local_content])
  20
  21     test "works by id" do
  22       %User{id: user_id} = insert(:user)
  23
  24       assert %{"id" => ^user_id} =
  25                build_conn()
  26                |> get("/api/v1/accounts/#{user_id}")
  27                |> json_response_and_validate_schema(200)
  28
  29       assert %{"error" => "Can't find user"} =
  30                build_conn()
  31                |> get("/api/v1/accounts/-1")
  32                |> json_response_and_validate_schema(404)
  33     end
  34
  35     test "works by nickname" do
  36       user = insert(:user)
  37
  38       assert %{"id" => user_id} =
  39                build_conn()
  40                |> get("/api/v1/accounts/#{user.nickname}")
  41                |> json_response_and_validate_schema(200)
  42     end
  43
  44     test "works by nickname for remote users" do
  45       Config.put([:instance, :limit_to_local_content], false)
  46
  47       user = insert(:user, nickname: "user@example.com", local: false)
  48
  49       assert %{"id" => user_id} =
  50                build_conn()
  51                |> get("/api/v1/accounts/#{user.nickname}")
  52                |> json_response_and_validate_schema(200)
  53     end
  54
  55     test "respects limit_to_local_content == :all for remote user nicknames" do
  56       Config.put([:instance, :limit_to_local_content], :all)
  57
  58       user = insert(:user, nickname: "user@example.com", local: false)
  59
  60       assert build_conn()
  61              |> get("/api/v1/accounts/#{user.nickname}")
  62              |> json_response_and_validate_schema(404)
  63     end
  64
  65     test "respects limit_to_local_content == :unauthenticated for remote user nicknames" do
  66       Config.put([:instance, :limit_to_local_content], :unauthenticated)
  67
  68       user = insert(:user, nickname: "user@example.com", local: false)
  69       reading_user = insert(:user)
  70
  71       conn =
  72         build_conn()
  73         |> get("/api/v1/accounts/#{user.nickname}")
  74
  75       assert json_response_and_validate_schema(conn, 404)
  76
  77       conn =
  78         build_conn()
  79         |> assign(:user, reading_user)
  80         |> assign(:token, insert(:oauth_token, user: reading_user, scopes: ["read:accounts"]))
  81         |> get("/api/v1/accounts/#{user.nickname}")
  82
  83       assert %{"id" => id} = json_response_and_validate_schema(conn, 200)
  84       assert id == user.id
  85     end
  86
  87     test "accounts fetches correct account for nicknames beginning with numbers", %{conn: conn} do
  88       # Need to set an old-style integer ID to reproduce the problem
  89       # (these are no longer assigned to new accounts but were preserved
  90       # for existing accounts during the migration to flakeIDs)
  91       user_one = insert(:user, %{id: 1212})
  92       user_two = insert(:user, %{nickname: "#{user_one.id}garbage"})
  93
  94       acc_one =
  95         conn
  96         |> get("/api/v1/accounts/#{user_one.id}")
  97         |> json_response_and_validate_schema(:ok)
  98
  99       acc_two =
 100         conn
 101         |> get("/api/v1/accounts/#{user_two.nickname}")
 102         |> json_response_and_validate_schema(:ok)
 103
 104       acc_three =
 105         conn
 106         |> get("/api/v1/accounts/#{user_two.id}")
 107         |> json_response_and_validate_schema(:ok)
 108
 109       refute acc_one == acc_two
 110       assert acc_two == acc_three
 111     end
 112
 113     test "returns 404 when user is invisible", %{conn: conn} do
 114       user = insert(:user, %{invisible: true})
 115
 116       assert %{"error" => "Can't find user"} =
 117                conn
 118                |> get("/api/v1/accounts/#{user.nickname}")
 119                |> json_response_and_validate_schema(404)
 120     end
 121
 122     test "returns 404 for internal.fetch actor", %{conn: conn} do
 123       %User{nickname: "internal.fetch"} = InternalFetchActor.get_actor()
 124
 125       assert %{"error" => "Can't find user"} =
 126                conn
 127                |> get("/api/v1/accounts/internal.fetch")
 128                |> json_response_and_validate_schema(404)
 129     end
 130   end
 131
 132   defp local_and_remote_users do
 133     local = insert(:user)
 134     remote = insert(:user, local: false)
 135     {:ok, local: local, remote: remote}
 136   end
 137
 138   describe "user fetching with restrict unauthenticated profiles for local and remote" do
 139     setup do: local_and_remote_users()
 140
 141     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 142
 143     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 144
 145     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 146       assert %{"error" => "Can't find user"} ==
 147                conn
 148                |> get("/api/v1/accounts/#{local.id}")
 149                |> json_response_and_validate_schema(:not_found)
 150
 151       assert %{"error" => "Can't find user"} ==
 152                conn
 153                |> get("/api/v1/accounts/#{remote.id}")
 154                |> json_response_and_validate_schema(:not_found)
 155     end
 156
 157     test "if user is authenticated", %{local: local, remote: remote} do
 158       %{conn: conn} = oauth_access(["read"])
 159
 160       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 161       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 162
 163       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 164       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 165     end
 166   end
 167
 168   describe "user fetching with restrict unauthenticated profiles for local" do
 169     setup do: local_and_remote_users()
 170
 171     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 172
 173     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 174       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 175
 176       assert json_response_and_validate_schema(res_conn, :not_found) == %{
 177                "error" => "Can't find user"
 178              }
 179
 180       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 181       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 182     end
 183
 184     test "if user is authenticated", %{local: local, remote: remote} do
 185       %{conn: conn} = oauth_access(["read"])
 186
 187       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 188       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 189
 190       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 191       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 192     end
 193   end
 194
 195   describe "user fetching with restrict unauthenticated profiles for remote" do
 196     setup do: local_and_remote_users()
 197
 198     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 199
 200     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 201       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 202       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 203
 204       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 205
 206       assert json_response_and_validate_schema(res_conn, :not_found) == %{
 207                "error" => "Can't find user"
 208              }
 209     end
 210
 211     test "if user is authenticated", %{local: local, remote: remote} do
 212       %{conn: conn} = oauth_access(["read"])
 213
 214       res_conn = get(conn, "/api/v1/accounts/#{local.id}")
 215       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 216
 217       res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
 218       assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
 219     end
 220   end
 221
 222   describe "user timelines" do
 223     setup do: oauth_access(["read:statuses"])
 224
 225     test "works with announces that are just addressed to public", %{conn: conn} do
 226       user = insert(:user, ap_id: "https://honktest/u/test", local: false)
 227       other_user = insert(:user)
 228
 229       {:ok, post} = CommonAPI.post(other_user, %{status: "bonkeronk"})
 230
 231       {:ok, announce, _} =
 232         %{
 233           "@context" => "https://www.w3.org/ns/activitystreams",
 234           "actor" => "https://honktest/u/test",
 235           "id" => "https://honktest/u/test/bonk/1793M7B9MQ48847vdx",
 236           "object" => post.data["object"],
 237           "published" => "2019-06-25T19:33:58Z",
 238           "to" => ["https://www.w3.org/ns/activitystreams#Public"],
 239           "type" => "Announce"
 240         }
 241         |> ActivityPub.persist(local: false)
 242
 243       assert resp =
 244                conn
 245                |> get("/api/v1/accounts/#{user.id}/statuses")
 246                |> json_response_and_validate_schema(200)
 247
 248       assert [%{"id" => id}] = resp
 249       assert id == announce.id
 250     end
 251
 252     test "respects blocks", %{user: user_one, conn: conn} do
 253       user_two = insert(:user)
 254       user_three = insert(:user)
 255
 256       User.block(user_one, user_two)
 257
 258       {:ok, activity} = CommonAPI.post(user_two, %{status: "User one sux0rz"})
 259       {:ok, repeat, _} = CommonAPI.repeat(activity.id, user_three)
 260
 261       assert resp =
 262                conn
 263                |> get("/api/v1/accounts/#{user_two.id}/statuses")
 264                |> json_response_and_validate_schema(200)
 265
 266       assert [%{"id" => id}] = resp
 267       assert id == activity.id
 268
 269       # Even a blocked user will deliver the full user timeline, there would be
 270       #   no point in looking at a blocked users timeline otherwise
 271       assert resp =
 272                conn
 273                |> get("/api/v1/accounts/#{user_two.id}/statuses")
 274                |> json_response_and_validate_schema(200)
 275
 276       assert [%{"id" => id}] = resp
 277       assert id == activity.id
 278
 279       # Third user's timeline includes the repeat when viewed by unauthenticated user
 280       resp =
 281         build_conn()
 282         |> get("/api/v1/accounts/#{user_three.id}/statuses")
 283         |> json_response_and_validate_schema(200)
 284
 285       assert [%{"id" => id}] = resp
 286       assert id == repeat.id
 287
 288       # When viewing a third user's timeline, the blocked users' statuses will NOT be shown
 289       resp = get(conn, "/api/v1/accounts/#{user_three.id}/statuses")
 290
 291       assert [] == json_response_and_validate_schema(resp, 200)
 292     end
 293
 294     test "gets users statuses", %{conn: conn} do
 295       user_one = insert(:user)
 296       user_two = insert(:user)
 297       user_three = insert(:user)
 298
 299       {:ok, _user_three} = User.follow(user_three, user_one)
 300
 301       {:ok, activity} = CommonAPI.post(user_one, %{status: "HI!!!"})
 302
 303       {:ok, direct_activity} =
 304         CommonAPI.post(user_one, %{
 305           status: "Hi, @#{user_two.nickname}.",
 306           visibility: "direct"
 307         })
 308
 309       {:ok, private_activity} =
 310         CommonAPI.post(user_one, %{status: "private", visibility: "private"})
 311
 312       # TODO!!!
 313       resp =
 314         conn
 315         |> get("/api/v1/accounts/#{user_one.id}/statuses")
 316         |> json_response_and_validate_schema(200)
 317
 318       assert [%{"id" => id}] = resp
 319       assert id == to_string(activity.id)
 320
 321       resp =
 322         conn
 323         |> assign(:user, user_two)
 324         |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
 325         |> get("/api/v1/accounts/#{user_one.id}/statuses")
 326         |> json_response_and_validate_schema(200)
 327
 328       assert [%{"id" => id_one}, %{"id" => id_two}] = resp
 329       assert id_one == to_string(direct_activity.id)
 330       assert id_two == to_string(activity.id)
 331
 332       resp =
 333         conn
 334         |> assign(:user, user_three)
 335         |> assign(:token, insert(:oauth_token, user: user_three, scopes: ["read:statuses"]))
 336         |> get("/api/v1/accounts/#{user_one.id}/statuses")
 337         |> json_response_and_validate_schema(200)
 338
 339       assert [%{"id" => id_one}, %{"id" => id_two}] = resp
 340       assert id_one == to_string(private_activity.id)
 341       assert id_two == to_string(activity.id)
 342     end
 343
 344     test "unimplemented pinned statuses feature", %{conn: conn} do
 345       note = insert(:note_activity)
 346       user = User.get_cached_by_ap_id(note.data["actor"])
 347
 348       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?pinned=true")
 349
 350       assert json_response_and_validate_schema(conn, 200) == []
 351     end
 352
 353     test "gets an users media", %{conn: conn} do
 354       note = insert(:note_activity)
 355       user = User.get_cached_by_ap_id(note.data["actor"])
 356
 357       file = %Plug.Upload{
 358         content_type: "image/jpg",
 359         path: Path.absname("test/fixtures/image.jpg"),
 360         filename: "an_image.jpg"
 361       }
 362
 363       {:ok, %{id: media_id}} = ActivityPub.upload(file, actor: user.ap_id)
 364
 365       {:ok, %{id: image_post_id}} = CommonAPI.post(user, %{status: "cofe", media_ids: [media_id]})
 366
 367       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?only_media=true")
 368
 369       assert [%{"id" => ^image_post_id}] = json_response_and_validate_schema(conn, 200)
 370
 371       conn = get(build_conn(), "/api/v1/accounts/#{user.id}/statuses?only_media=1")
 372
 373       assert [%{"id" => ^image_post_id}] = json_response_and_validate_schema(conn, 200)
 374     end
 375
 376     test "gets a user's statuses without reblogs", %{user: user, conn: conn} do
 377       {:ok, %{id: post_id}} = CommonAPI.post(user, %{status: "HI!!!"})
 378       {:ok, _, _} = CommonAPI.repeat(post_id, user)
 379
 380       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_reblogs=true")
 381       assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)
 382
 383       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_reblogs=1")
 384       assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)
 385     end
 386
 387     test "filters user's statuses by a hashtag", %{user: user, conn: conn} do
 388       {:ok, %{id: post_id}} = CommonAPI.post(user, %{status: "#hashtag"})
 389       {:ok, _post} = CommonAPI.post(user, %{status: "hashtag"})
 390
 391       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?tagged=hashtag")
 392       assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)
 393     end
 394
 395     test "the user views their own timelines and excludes direct messages", %{
 396       user: user,
 397       conn: conn
 398     } do
 399       {:ok, %{id: public_activity_id}} =
 400         CommonAPI.post(user, %{status: ".", visibility: "public"})
 401
 402       {:ok, _direct_activity} = CommonAPI.post(user, %{status: ".", visibility: "direct"})
 403
 404       conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_visibilities[]=direct")
 405       assert [%{"id" => ^public_activity_id}] = json_response_and_validate_schema(conn, 200)
 406     end
 407   end
 408
 409   defp local_and_remote_activities(%{local: local, remote: remote}) do
 410     insert(:note_activity, user: local)
 411     insert(:note_activity, user: remote, local: false)
 412
 413     :ok
 414   end
 415
 416   describe "statuses with restrict unauthenticated profiles for local and remote" do
 417     setup do: local_and_remote_users()
 418     setup :local_and_remote_activities
 419
 420     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 421
 422     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 423
 424     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 425       assert %{"error" => "Can't find user"} ==
 426                conn
 427                |> get("/api/v1/accounts/#{local.id}/statuses")
 428                |> json_response_and_validate_schema(:not_found)
 429
 430       assert %{"error" => "Can't find user"} ==
 431                conn
 432                |> get("/api/v1/accounts/#{remote.id}/statuses")
 433                |> json_response_and_validate_schema(:not_found)
 434     end
 435
 436     test "if user is authenticated", %{local: local, remote: remote} do
 437       %{conn: conn} = oauth_access(["read"])
 438
 439       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 440       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 441
 442       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 443       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 444     end
 445   end
 446
 447   describe "statuses with restrict unauthenticated profiles for local" do
 448     setup do: local_and_remote_users()
 449     setup :local_and_remote_activities
 450
 451     setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)
 452
 453     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 454       assert %{"error" => "Can't find user"} ==
 455                conn
 456                |> get("/api/v1/accounts/#{local.id}/statuses")
 457                |> json_response_and_validate_schema(:not_found)
 458
 459       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 460       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 461     end
 462
 463     test "if user is authenticated", %{local: local, remote: remote} do
 464       %{conn: conn} = oauth_access(["read"])
 465
 466       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 467       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 468
 469       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 470       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 471     end
 472   end
 473
 474   describe "statuses with restrict unauthenticated profiles for remote" do
 475     setup do: local_and_remote_users()
 476     setup :local_and_remote_activities
 477
 478     setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)
 479
 480     test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
 481       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 482       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 483
 484       assert %{"error" => "Can't find user"} ==
 485                conn
 486                |> get("/api/v1/accounts/#{remote.id}/statuses")
 487                |> json_response_and_validate_schema(:not_found)
 488     end
 489
 490     test "if user is authenticated", %{local: local, remote: remote} do
 491       %{conn: conn} = oauth_access(["read"])
 492
 493       res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
 494       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 495
 496       res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
 497       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 498     end
 499   end
 500
 501   describe "followers" do
 502     setup do: oauth_access(["read:accounts"])
 503
 504     test "getting followers", %{user: user, conn: conn} do
 505       other_user = insert(:user)
 506       {:ok, %{id: user_id}} = User.follow(user, other_user)
 507
 508       conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")
 509
 510       assert [%{"id" => ^user_id}] = json_response_and_validate_schema(conn, 200)
 511     end
 512
 513     test "getting followers, hide_followers", %{user: user, conn: conn} do
 514       other_user = insert(:user, hide_followers: true)
 515       {:ok, _user} = User.follow(user, other_user)
 516
 517       conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")
 518
 519       assert [] == json_response_and_validate_schema(conn, 200)
 520     end
 521
 522     test "getting followers, hide_followers, same user requesting" do
 523       user = insert(:user)
 524       other_user = insert(:user, hide_followers: true)
 525       {:ok, _user} = User.follow(user, other_user)
 526
 527       conn =
 528         build_conn()
 529         |> assign(:user, other_user)
 530         |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
 531         |> get("/api/v1/accounts/#{other_user.id}/followers")
 532
 533       refute [] == json_response_and_validate_schema(conn, 200)
 534     end
 535
 536     test "getting followers, pagination", %{user: user, conn: conn} do
 537       {:ok, %User{id: follower1_id}} = :user |> insert() |> User.follow(user)
 538       {:ok, %User{id: follower2_id}} = :user |> insert() |> User.follow(user)
 539       {:ok, %User{id: follower3_id}} = :user |> insert() |> User.follow(user)
 540
 541       assert [%{"id" => ^follower3_id}, %{"id" => ^follower2_id}] =
 542                conn
 543                |> get("/api/v1/accounts/#{user.id}/followers?since_id=#{follower1_id}")
 544                |> json_response_and_validate_schema(200)
 545
 546       assert [%{"id" => ^follower2_id}, %{"id" => ^follower1_id}] =
 547                conn
 548                |> get("/api/v1/accounts/#{user.id}/followers?max_id=#{follower3_id}")
 549                |> json_response_and_validate_schema(200)
 550
 551       res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?limit=1&max_id=#{follower3_id}")
 552
 553       assert [%{"id" => ^follower2_id}] = json_response_and_validate_schema(res_conn, 200)
 554
 555       assert [link_header] = get_resp_header(res_conn, "link")
 556       assert link_header =~ ~r/min_id=#{follower2_id}/
 557       assert link_header =~ ~r/max_id=#{follower2_id}/
 558     end
 559   end
 560
 561   describe "following" do
 562     setup do: oauth_access(["read:accounts"])
 563
 564     test "getting following", %{user: user, conn: conn} do
 565       other_user = insert(:user)
 566       {:ok, user} = User.follow(user, other_user)
 567
 568       conn = get(conn, "/api/v1/accounts/#{user.id}/following")
 569
 570       assert [%{"id" => id}] = json_response_and_validate_schema(conn, 200)
 571       assert id == to_string(other_user.id)
 572     end
 573
 574     test "getting following, hide_follows, other user requesting" do
 575       user = insert(:user, hide_follows: true)
 576       other_user = insert(:user)
 577       {:ok, user} = User.follow(user, other_user)
 578
 579       conn =
 580         build_conn()
 581         |> assign(:user, other_user)
 582         |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
 583         |> get("/api/v1/accounts/#{user.id}/following")
 584
 585       assert [] == json_response_and_validate_schema(conn, 200)
 586     end
 587
 588     test "getting following, hide_follows, same user requesting" do
 589       user = insert(:user, hide_follows: true)
 590       other_user = insert(:user)
 591       {:ok, user} = User.follow(user, other_user)
 592
 593       conn =
 594         build_conn()
 595         |> assign(:user, user)
 596         |> assign(:token, insert(:oauth_token, user: user, scopes: ["read:accounts"]))
 597         |> get("/api/v1/accounts/#{user.id}/following")
 598
 599       refute [] == json_response_and_validate_schema(conn, 200)
 600     end
 601
 602     test "getting following, pagination", %{user: user, conn: conn} do
 603       following1 = insert(:user)
 604       following2 = insert(:user)
 605       following3 = insert(:user)
 606       {:ok, _} = User.follow(user, following1)
 607       {:ok, _} = User.follow(user, following2)
 608       {:ok, _} = User.follow(user, following3)
 609
 610       res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?since_id=#{following1.id}")
 611
 612       assert [%{"id" => id3}, %{"id" => id2}] = json_response_and_validate_schema(res_conn, 200)
 613       assert id3 == following3.id
 614       assert id2 == following2.id
 615
 616       res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?max_id=#{following3.id}")
 617
 618       assert [%{"id" => id2}, %{"id" => id1}] = json_response_and_validate_schema(res_conn, 200)
 619       assert id2 == following2.id
 620       assert id1 == following1.id
 621
 622       res_conn =
 623         get(conn, "/api/v1/accounts/#{user.id}/following?limit=1&max_id=#{following3.id}")
 624
 625       assert [%{"id" => id2}] = json_response_and_validate_schema(res_conn, 200)
 626       assert id2 == following2.id
 627
 628       assert [link_header] = get_resp_header(res_conn, "link")
 629       assert link_header =~ ~r/min_id=#{following2.id}/
 630       assert link_header =~ ~r/max_id=#{following2.id}/
 631     end
 632   end
 633
 634   describe "follow/unfollow" do
 635     setup do: oauth_access(["follow"])
 636
 637     test "following / unfollowing a user", %{conn: conn} do
 638       %{id: other_user_id, nickname: other_user_nickname} = insert(:user)
 639
 640       assert %{"id" => _id, "following" => true} =
 641                conn
 642                |> post("/api/v1/accounts/#{other_user_id}/follow")
 643                |> json_response_and_validate_schema(200)
 644
 645       assert %{"id" => _id, "following" => false} =
 646                conn
 647                |> post("/api/v1/accounts/#{other_user_id}/unfollow")
 648                |> json_response_and_validate_schema(200)
 649
 650       assert %{"id" => ^other_user_id} =
 651                conn
 652                |> put_req_header("content-type", "application/json")
 653                |> post("/api/v1/follows", %{"uri" => other_user_nickname})
 654                |> json_response_and_validate_schema(200)
 655     end
 656
 657     test "cancelling follow request", %{conn: conn} do
 658       %{id: other_user_id} = insert(:user, %{locked: true})
 659
 660       assert %{"id" => ^other_user_id, "following" => false, "requested" => true} =
 661                conn
 662                |> post("/api/v1/accounts/#{other_user_id}/follow")
 663                |> json_response_and_validate_schema(:ok)
 664
 665       assert %{"id" => ^other_user_id, "following" => false, "requested" => false} =
 666                conn
 667                |> post("/api/v1/accounts/#{other_user_id}/unfollow")
 668                |> json_response_and_validate_schema(:ok)
 669     end
 670
 671     test "following without reblogs" do
 672       %{conn: conn} = oauth_access(["follow", "read:statuses"])
 673       followed = insert(:user)
 674       other_user = insert(:user)
 675
 676       ret_conn = post(conn, "/api/v1/accounts/#{followed.id}/follow?reblogs=false")
 677
 678       assert %{"showing_reblogs" => false} = json_response_and_validate_schema(ret_conn, 200)
 679
 680       {:ok, activity} = CommonAPI.post(other_user, %{status: "hey"})
 681       {:ok, %{id: reblog_id}, _} = CommonAPI.repeat(activity.id, followed)
 682
 683       assert [] ==
 684                conn
 685                |> get("/api/v1/timelines/home")
 686                |> json_response(200)
 687
 688       assert %{"showing_reblogs" => true} =
 689                conn
 690                |> post("/api/v1/accounts/#{followed.id}/follow?reblogs=true")
 691                |> json_response_and_validate_schema(200)
 692
 693       assert [%{"id" => ^reblog_id}] =
 694                conn
 695                |> get("/api/v1/timelines/home")
 696                |> json_response(200)
 697     end
 698
 699     test "following / unfollowing errors", %{user: user, conn: conn} do
 700       # self follow
 701       conn_res = post(conn, "/api/v1/accounts/#{user.id}/follow")
 702
 703       assert %{"error" => "Can not follow yourself"} =
 704                json_response_and_validate_schema(conn_res, 400)
 705
 706       # self unfollow
 707       user = User.get_cached_by_id(user.id)
 708       conn_res = post(conn, "/api/v1/accounts/#{user.id}/unfollow")
 709
 710       assert %{"error" => "Can not unfollow yourself"} =
 711                json_response_and_validate_schema(conn_res, 400)
 712
 713       # self follow via uri
 714       user = User.get_cached_by_id(user.id)
 715
 716       assert %{"error" => "Can not follow yourself"} =
 717                conn
 718                |> put_req_header("content-type", "multipart/form-data")
 719                |> post("/api/v1/follows", %{"uri" => user.nickname})
 720                |> json_response_and_validate_schema(400)
 721
 722       # follow non existing user
 723       conn_res = post(conn, "/api/v1/accounts/doesntexist/follow")
 724       assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)
 725
 726       # follow non existing user via uri
 727       conn_res =
 728         conn
 729         |> put_req_header("content-type", "multipart/form-data")
 730         |> post("/api/v1/follows", %{"uri" => "doesntexist"})
 731
 732       assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)
 733
 734       # unfollow non existing user
 735       conn_res = post(conn, "/api/v1/accounts/doesntexist/unfollow")
 736       assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)
 737     end
 738   end
 739
 740   describe "mute/unmute" do
 741     setup do: oauth_access(["write:mutes"])
 742
 743     test "with notifications", %{conn: conn} do
 744       other_user = insert(:user)
 745
 746       assert %{"id" => _id, "muting" => true, "muting_notifications" => true} =
 747                conn
 748                |> put_req_header("content-type", "application/json")
 749                |> post("/api/v1/accounts/#{other_user.id}/mute")
 750                |> json_response_and_validate_schema(200)
 751
 752       conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")
 753
 754       assert %{"id" => _id, "muting" => false, "muting_notifications" => false} =
 755                json_response_and_validate_schema(conn, 200)
 756     end
 757
 758     test "without notifications", %{conn: conn} do
 759       other_user = insert(:user)
 760
 761       ret_conn =
 762         conn
 763         |> put_req_header("content-type", "multipart/form-data")
 764         |> post("/api/v1/accounts/#{other_user.id}/mute", %{"notifications" => "false"})
 765
 766       assert %{"id" => _id, "muting" => true, "muting_notifications" => false} =
 767                json_response_and_validate_schema(ret_conn, 200)
 768
 769       conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")
 770
 771       assert %{"id" => _id, "muting" => false, "muting_notifications" => false} =
 772                json_response_and_validate_schema(conn, 200)
 773     end
 774   end
 775
 776   describe "pinned statuses" do
 777     setup do
 778       user = insert(:user)
 779       {:ok, activity} = CommonAPI.post(user, %{status: "HI!!!"})
 780       %{conn: conn} = oauth_access(["read:statuses"], user: user)
 781
 782       [conn: conn, user: user, activity: activity]
 783     end
 784
 785     test "returns pinned statuses", %{conn: conn, user: user, activity: %{id: activity_id}} do
 786       {:ok, _} = CommonAPI.pin(activity_id, user)
 787
 788       assert [%{"id" => ^activity_id, "pinned" => true}] =
 789                conn
 790                |> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
 791                |> json_response_and_validate_schema(200)
 792     end
 793   end
 794
 795   test "blocking / unblocking a user" do
 796     %{conn: conn} = oauth_access(["follow"])
 797     other_user = insert(:user)
 798
 799     ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/block")
 800
 801     assert %{"id" => _id, "blocking" => true} = json_response_and_validate_schema(ret_conn, 200)
 802
 803     conn = post(conn, "/api/v1/accounts/#{other_user.id}/unblock")
 804
 805     assert %{"id" => _id, "blocking" => false} = json_response_and_validate_schema(conn, 200)
 806   end
 807
 808   describe "create account by app" do
 809     setup do
 810       valid_params = %{
 811         username: "lain",
 812         email: "lain@example.org",
 813         password: "PlzDontHackLain",
 814         agreement: true
 815       }
 816
 817       [valid_params: valid_params]
 818     end
 819
 820     setup do: clear_config([:instance, :account_activation_required])
 821
 822     test "Account registration via Application", %{conn: conn} do
 823       conn =
 824         conn
 825         |> put_req_header("content-type", "application/json")
 826         |> post("/api/v1/apps", %{
 827           client_name: "client_name",
 828           redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
 829           scopes: "read, write, follow"
 830         })
 831
 832       assert %{
 833                "client_id" => client_id,
 834                "client_secret" => client_secret,
 835                "id" => _,
 836                "name" => "client_name",
 837                "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
 838                "vapid_key" => _,
 839                "website" => nil
 840              } = json_response_and_validate_schema(conn, 200)
 841
 842       conn =
 843         post(conn, "/oauth/token", %{
 844           grant_type: "client_credentials",
 845           client_id: client_id,
 846           client_secret: client_secret
 847         })
 848
 849       assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
 850                json_response(conn, 200)
 851
 852       assert token
 853       token_from_db = Repo.get_by(Token, token: token)
 854       assert token_from_db
 855       assert refresh
 856       assert scope == "read write follow"
 857
 858       conn =
 859         build_conn()
 860         |> put_req_header("content-type", "multipart/form-data")
 861         |> put_req_header("authorization", "Bearer " <> token)
 862         |> post("/api/v1/accounts", %{
 863           username: "lain",
 864           email: "lain@example.org",
 865           password: "PlzDontHackLain",
 866           bio: "Test Bio",
 867           agreement: true
 868         })
 869
 870       %{
 871         "access_token" => token,
 872         "created_at" => _created_at,
 873         "scope" => _scope,
 874         "token_type" => "Bearer"
 875       } = json_response_and_validate_schema(conn, 200)
 876
 877       token_from_db = Repo.get_by(Token, token: token)
 878       assert token_from_db
 879       token_from_db = Repo.preload(token_from_db, :user)
 880       assert token_from_db.user
 881
 882       assert token_from_db.user.confirmation_pending
 883     end
 884
 885     test "returns error when user already registred", %{conn: conn, valid_params: valid_params} do
 886       _user = insert(:user, email: "lain@example.org")
 887       app_token = insert(:oauth_token, user: nil)
 888
 889       res =
 890         conn
 891         |> put_req_header("authorization", "Bearer " <> app_token.token)
 892         |> put_req_header("content-type", "application/json")
 893         |> post("/api/v1/accounts", valid_params)
 894
 895       assert json_response_and_validate_schema(res, 400) == %{
 896                "error" => "{\"email\":[\"has already been taken\"]}"
 897              }
 898     end
 899
 900     test "returns bad_request if missing required params", %{
 901       conn: conn,
 902       valid_params: valid_params
 903     } do
 904       app_token = insert(:oauth_token, user: nil)
 905
 906       conn =
 907         conn
 908         |> put_req_header("authorization", "Bearer " <> app_token.token)
 909         |> put_req_header("content-type", "application/json")
 910
 911       res = post(conn, "/api/v1/accounts", valid_params)
 912       assert json_response_and_validate_schema(res, 200)
 913
 914       [{127, 0, 0, 1}, {127, 0, 0, 2}, {127, 0, 0, 3}, {127, 0, 0, 4}]
 915       |> Stream.zip(Map.delete(valid_params, :email))
 916       |> Enum.each(fn {ip, {attr, _}} ->
 917         res =
 918           conn
 919           |> Map.put(:remote_ip, ip)
 920           |> post("/api/v1/accounts", Map.delete(valid_params, attr))
 921           |> json_response_and_validate_schema(400)
 922
 923         assert res == %{
 924                  "error" => "Missing field: #{attr}.",
 925                  "errors" => [
 926                    %{
 927                      "message" => "Missing field: #{attr}",
 928                      "source" => %{"pointer" => "/#{attr}"},
 929                      "title" => "Invalid value"
 930                    }
 931                  ]
 932                }
 933       end)
 934     end
 935
 936     setup do: clear_config([:instance, :account_activation_required])
 937
 938     test "returns bad_request if missing email params when :account_activation_required is enabled",
 939          %{conn: conn, valid_params: valid_params} do
 940       Pleroma.Config.put([:instance, :account_activation_required], true)
 941
 942       app_token = insert(:oauth_token, user: nil)
 943
 944       conn =
 945         conn
 946         |> put_req_header("authorization", "Bearer " <> app_token.token)
 947         |> put_req_header("content-type", "application/json")
 948
 949       res =
 950         conn
 951         |> Map.put(:remote_ip, {127, 0, 0, 5})
 952         |> post("/api/v1/accounts", Map.delete(valid_params, :email))
 953
 954       assert json_response_and_validate_schema(res, 400) ==
 955                %{"error" => "Missing parameter: email"}
 956
 957       res =
 958         conn
 959         |> Map.put(:remote_ip, {127, 0, 0, 6})
 960         |> post("/api/v1/accounts", Map.put(valid_params, :email, ""))
 961
 962       assert json_response_and_validate_schema(res, 400) == %{
 963                "error" => "{\"email\":[\"can't be blank\"]}"
 964              }
 965     end
 966
 967     test "allow registration without an email", %{conn: conn, valid_params: valid_params} do
 968       app_token = insert(:oauth_token, user: nil)
 969       conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
 970
 971       res =
 972         conn
 973         |> put_req_header("content-type", "application/json")
 974         |> Map.put(:remote_ip, {127, 0, 0, 7})
 975         |> post("/api/v1/accounts", Map.delete(valid_params, :email))
 976
 977       assert json_response_and_validate_schema(res, 200)
 978     end
 979
 980     test "allow registration with an empty email", %{conn: conn, valid_params: valid_params} do
 981       app_token = insert(:oauth_token, user: nil)
 982       conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)
 983
 984       res =
 985         conn
 986         |> put_req_header("content-type", "application/json")
 987         |> Map.put(:remote_ip, {127, 0, 0, 8})
 988         |> post("/api/v1/accounts", Map.put(valid_params, :email, ""))
 989
 990       assert json_response_and_validate_schema(res, 200)
 991     end
 992
 993     test "returns forbidden if token is invalid", %{conn: conn, valid_params: valid_params} do
 994       res =
 995         conn
 996         |> put_req_header("authorization", "Bearer " <> "invalid-token")
 997         |> put_req_header("content-type", "multipart/form-data")
 998         |> post("/api/v1/accounts", valid_params)
 999
1000       assert json_response_and_validate_schema(res, 403) == %{"error" => "Invalid credentials"}
1001     end
1002
1003     test "registration from trusted app" do
1004       clear_config([Pleroma.Captcha, :enabled], true)
1005       app = insert(:oauth_app, trusted: true, scopes: ["read", "write", "follow", "push"])
1006
1007       conn =
1008         build_conn()
1009         |> post("/oauth/token", %{
1010           "grant_type" => "client_credentials",
1011           "client_id" => app.client_id,
1012           "client_secret" => app.client_secret
1013         })
1014
1015       assert %{"access_token" => token, "token_type" => "Bearer"} = json_response(conn, 200)
1016
1017       response =
1018         build_conn()
1019         |> Plug.Conn.put_req_header("authorization", "Bearer " <> token)
1020         |> put_req_header("content-type", "multipart/form-data")
1021         |> post("/api/v1/accounts", %{
1022           nickname: "nickanme",
1023           agreement: true,
1024           email: "email@example.com",
1025           fullname: "Lain",
1026           username: "Lain",
1027           password: "some_password",
1028           confirm: "some_password"
1029         })
1030         |> json_response_and_validate_schema(200)
1031
1032       assert %{
1033                "access_token" => access_token,
1034                "created_at" => _,
1035                "scope" => ["read", "write", "follow", "push"],
1036                "token_type" => "Bearer"
1037              } = response
1038
1039       response =
1040         build_conn()
1041         |> Plug.Conn.put_req_header("authorization", "Bearer " <> access_token)
1042         |> get("/api/v1/accounts/verify_credentials")
1043         |> json_response_and_validate_schema(200)
1044
1045       assert %{
1046                "acct" => "Lain",
1047                "bot" => false,
1048                "display_name" => "Lain",
1049                "follow_requests_count" => 0,
1050                "followers_count" => 0,
1051                "following_count" => 0,
1052                "locked" => false,
1053                "note" => "",
1054                "source" => %{
1055                  "fields" => [],
1056                  "note" => "",
1057                  "pleroma" => %{
1058                    "actor_type" => "Person",
1059                    "discoverable" => false,
1060                    "no_rich_text" => false,
1061                    "show_role" => true
1062                  },
1063                  "privacy" => "public",
1064                  "sensitive" => false
1065                },
1066                "statuses_count" => 0,
1067                "username" => "Lain"
1068              } = response
1069     end
1070   end
1071
1072   describe "create account by app / rate limit" do
1073     setup do: clear_config([:rate_limit, :app_account_creation], {10_000, 2})
1074
1075     test "respects rate limit setting", %{conn: conn} do
1076       app_token = insert(:oauth_token, user: nil)
1077
1078       conn =
1079         conn
1080         |> put_req_header("authorization", "Bearer " <> app_token.token)
1081         |> Map.put(:remote_ip, {15, 15, 15, 15})
1082         |> put_req_header("content-type", "multipart/form-data")
1083
1084       for i <- 1..2 do
1085         conn =
1086           conn
1087           |> post("/api/v1/accounts", %{
1088             username: "#{i}lain",
1089             email: "#{i}lain@example.org",
1090             password: "PlzDontHackLain",
1091             agreement: true
1092           })
1093
1094         %{
1095           "access_token" => token,
1096           "created_at" => _created_at,
1097           "scope" => _scope,
1098           "token_type" => "Bearer"
1099         } = json_response_and_validate_schema(conn, 200)
1100
1101         token_from_db = Repo.get_by(Token, token: token)
1102         assert token_from_db
1103         token_from_db = Repo.preload(token_from_db, :user)
1104         assert token_from_db.user
1105
1106         assert token_from_db.user.confirmation_pending
1107       end
1108
1109       conn =
1110         post(conn, "/api/v1/accounts", %{
1111           username: "6lain",
1112           email: "6lain@example.org",
1113           password: "PlzDontHackLain",
1114           agreement: true
1115         })
1116
1117       assert json_response_and_validate_schema(conn, :too_many_requests) == %{
1118                "error" => "Throttled"
1119              }
1120     end
1121   end
1122
1123   describe "create account with enabled captcha" do
1124     setup %{conn: conn} do
1125       app_token = insert(:oauth_token, user: nil)
1126
1127       conn =
1128         conn
1129         |> put_req_header("authorization", "Bearer " <> app_token.token)
1130         |> put_req_header("content-type", "multipart/form-data")
1131
1132       [conn: conn]
1133     end
1134
1135     setup do: clear_config([Pleroma.Captcha, :enabled], true)
1136
1137     test "creates an account and returns 200 if captcha is valid", %{conn: conn} do
1138       %{token: token, answer_data: answer_data} = Pleroma.Captcha.new()
1139
1140       params = %{
1141         username: "lain",
1142         email: "lain@example.org",
1143         password: "PlzDontHackLain",
1144         agreement: true,
1145         captcha_solution: Pleroma.Captcha.Mock.solution(),
1146         captcha_token: token,
1147         captcha_answer_data: answer_data
1148       }
1149
1150       assert %{
1151                "access_token" => access_token,
1152                "created_at" => _,
1153                "scope" => ["read"],
1154                "token_type" => "Bearer"
1155              } =
1156                conn
1157                |> post("/api/v1/accounts", params)
1158                |> json_response_and_validate_schema(:ok)
1159
1160       assert Token |> Repo.get_by(token: access_token) |> Repo.preload(:user) |> Map.get(:user)
1161
1162       Cachex.del(:used_captcha_cache, token)
1163     end
1164
1165     test "returns 400 if any captcha field is not provided", %{conn: conn} do
1166       captcha_fields = [:captcha_solution, :captcha_token, :captcha_answer_data]
1167
1168       valid_params = %{
1169         username: "lain",
1170         email: "lain@example.org",
1171         password: "PlzDontHackLain",
1172         agreement: true,
1173         captcha_solution: "xx",
1174         captcha_token: "xx",
1175         captcha_answer_data: "xx"
1176       }
1177
1178       for field <- captcha_fields do
1179         expected = %{
1180           "error" => "{\"captcha\":[\"Invalid CAPTCHA (Missing parameter: #{field})\"]}"
1181         }
1182
1183         assert expected ==
1184                  conn
1185                  |> post("/api/v1/accounts", Map.delete(valid_params, field))
1186                  |> json_response_and_validate_schema(:bad_request)
1187       end
1188     end
1189
1190     test "returns an error if captcha is invalid", %{conn: conn} do
1191       params = %{
1192         username: "lain",
1193         email: "lain@example.org",
1194         password: "PlzDontHackLain",
1195         agreement: true,
1196         captcha_solution: "cofe",
1197         captcha_token: "cofe",
1198         captcha_answer_data: "cofe"
1199       }
1200
1201       assert %{"error" => "{\"captcha\":[\"Invalid answer data\"]}"} ==
1202                conn
1203                |> post("/api/v1/accounts", params)
1204                |> json_response_and_validate_schema(:bad_request)
1205     end
1206   end
1207
1208   describe "GET /api/v1/accounts/:id/lists - account_lists" do
1209     test "returns lists to which the account belongs" do
1210       %{user: user, conn: conn} = oauth_access(["read:lists"])
1211       other_user = insert(:user)
1212       assert {:ok, %Pleroma.List{id: list_id} = list} = Pleroma.List.create("Test List", user)
1213       {:ok, %{following: _following}} = Pleroma.List.follow(list, other_user)
1214
1215       assert [%{"id" => list_id, "title" => "Test List"}] =
1216                conn
1217                |> get("/api/v1/accounts/#{other_user.id}/lists")
1218                |> json_response_and_validate_schema(200)
1219     end
1220   end
1221
1222   describe "verify_credentials" do
1223     test "verify_credentials" do
1224       %{user: user, conn: conn} = oauth_access(["read:accounts"])
1225       [notification | _] = insert_list(7, :notification, user: user)
1226       Pleroma.Notification.set_read_up_to(user, notification.id)
1227       conn = get(conn, "/api/v1/accounts/verify_credentials")
1228
1229       response = json_response_and_validate_schema(conn, 200)
1230
1231       assert %{"id" => id, "source" => %{"privacy" => "public"}} = response
1232       assert response["pleroma"]["chat_token"]
1233       assert response["pleroma"]["unread_notifications_count"] == 6
1234       assert id == to_string(user.id)
1235     end
1236
1237     test "verify_credentials default scope unlisted" do
1238       user = insert(:user, default_scope: "unlisted")
1239       %{conn: conn} = oauth_access(["read:accounts"], user: user)
1240
1241       conn = get(conn, "/api/v1/accounts/verify_credentials")
1242
1243       assert %{"id" => id, "source" => %{"privacy" => "unlisted"}} =
1244                json_response_and_validate_schema(conn, 200)
1245
1246       assert id == to_string(user.id)
1247     end
1248
1249     test "locked accounts" do
1250       user = insert(:user, default_scope: "private")
1251       %{conn: conn} = oauth_access(["read:accounts"], user: user)
1252
1253       conn = get(conn, "/api/v1/accounts/verify_credentials")
1254
1255       assert %{"id" => id, "source" => %{"privacy" => "private"}} =
1256                json_response_and_validate_schema(conn, 200)
1257
1258       assert id == to_string(user.id)
1259     end
1260   end
1261
1262   describe "user relationships" do
1263     setup do: oauth_access(["read:follows"])
1264
1265     test "returns the relationships for the current user", %{user: user, conn: conn} do
1266       %{id: other_user_id} = other_user = insert(:user)
1267       {:ok, _user} = User.follow(user, other_user)
1268
1269       assert [%{"id" => ^other_user_id}] =
1270                conn
1271                |> get("/api/v1/accounts/relationships?id=#{other_user.id}")
1272                |> json_response_and_validate_schema(200)
1273
1274       assert [%{"id" => ^other_user_id}] =
1275                conn
1276                |> get("/api/v1/accounts/relationships?id[]=#{other_user.id}")
1277                |> json_response_and_validate_schema(200)
1278     end
1279
1280     test "returns an empty list on a bad request", %{conn: conn} do
1281       conn = get(conn, "/api/v1/accounts/relationships", %{})
1282
1283       assert [] = json_response_and_validate_schema(conn, 200)
1284     end
1285   end
1286
1287   test "getting a list of mutes" do
1288     %{user: user, conn: conn} = oauth_access(["read:mutes"])
1289     other_user = insert(:user)
1290
1291     {:ok, _user_relationships} = User.mute(user, other_user)
1292
1293     conn = get(conn, "/api/v1/mutes")
1294
1295     other_user_id = to_string(other_user.id)
1296     assert [%{"id" => ^other_user_id}] = json_response_and_validate_schema(conn, 200)
1297   end
1298
1299   test "getting a list of blocks" do
1300     %{user: user, conn: conn} = oauth_access(["read:blocks"])
1301     other_user = insert(:user)
1302
1303     {:ok, _user_relationship} = User.block(user, other_user)
1304
1305     conn =
1306       conn
1307       |> assign(:user, user)
1308       |> get("/api/v1/blocks")
1309
1310     other_user_id = to_string(other_user.id)
1311     assert [%{"id" => ^other_user_id}] = json_response_and_validate_schema(conn, 200)
1312   end
1313 end