git.squeep.com Git - akkoma/blob - test/web/mastodon_api/controllers/timeline_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.TimelineControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   import Pleroma.Factory
   9   import Tesla.Mock
  10
  11   alias Pleroma.Config
  12   alias Pleroma.User
  13   alias Pleroma.Web.CommonAPI
  14
  15   setup do
  16     mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
  17     :ok
  18   end
  19
  20   describe "home" do
  21     setup do: oauth_access(["read:statuses"])
  22
  23     test "does NOT render account/pleroma/relationship if this is disabled by default", %{
  24       user: user,
  25       conn: conn
  26     } do
  27       clear_config([:extensions, :output_relationships_in_statuses_by_default], false)
  28
  29       other_user = insert(:user)
  30
  31       {:ok, _} = CommonAPI.post(other_user, %{"status" => "hi @#{user.nickname}"})
  32
  33       response =
  34         conn
  35         |> assign(:user, user)
  36         |> get("/api/v1/timelines/home")
  37         |> json_response(200)
  38
  39       assert Enum.all?(response, fn n ->
  40                get_in(n, ["account", "pleroma", "relationship"]) == %{}
  41              end)
  42     end
  43
  44     test "the home timeline", %{user: user, conn: conn} do
  45       uri = "/api/v1/timelines/home?with_relationships=true"
  46
  47       following = insert(:user, nickname: "followed")
  48       third_user = insert(:user, nickname: "repeated")
  49
  50       {:ok, _activity} = CommonAPI.post(following, %{"status" => "post"})
  51       {:ok, activity} = CommonAPI.post(third_user, %{"status" => "repeated post"})
  52       {:ok, _, _} = CommonAPI.repeat(activity.id, following)
  53
  54       ret_conn = get(conn, uri)
  55
  56       assert Enum.empty?(json_response(ret_conn, :ok))
  57
  58       {:ok, _user} = User.follow(user, following)
  59
  60       ret_conn = get(conn, uri)
  61
  62       assert [
  63                %{
  64                  "reblog" => %{
  65                    "content" => "repeated post",
  66                    "account" => %{
  67                      "pleroma" => %{
  68                        "relationship" => %{"following" => false, "followed_by" => false}
  69                      }
  70                    }
  71                  },
  72                  "account" => %{"pleroma" => %{"relationship" => %{"following" => true}}}
  73                },
  74                %{
  75                  "content" => "post",
  76                  "account" => %{
  77                    "acct" => "followed",
  78                    "pleroma" => %{"relationship" => %{"following" => true}}
  79                  }
  80                }
  81              ] = json_response(ret_conn, :ok)
  82
  83       {:ok, _user} = User.follow(third_user, user)
  84
  85       ret_conn = get(conn, uri)
  86
  87       assert [
  88                %{
  89                  "reblog" => %{
  90                    "content" => "repeated post",
  91                    "account" => %{
  92                      "acct" => "repeated",
  93                      "pleroma" => %{
  94                        "relationship" => %{"following" => false, "followed_by" => true}
  95                      }
  96                    }
  97                  },
  98                  "account" => %{"pleroma" => %{"relationship" => %{"following" => true}}}
  99                },
 100                %{
 101                  "content" => "post",
 102                  "account" => %{
 103                    "acct" => "followed",
 104                    "pleroma" => %{"relationship" => %{"following" => true}}
 105                  }
 106                }
 107              ] = json_response(ret_conn, :ok)
 108     end
 109
 110     test "the home timeline when the direct messages are excluded", %{user: user, conn: conn} do
 111       {:ok, public_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "public"})
 112       {:ok, direct_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "direct"})
 113
 114       {:ok, unlisted_activity} =
 115         CommonAPI.post(user, %{"status" => ".", "visibility" => "unlisted"})
 116
 117       {:ok, private_activity} =
 118         CommonAPI.post(user, %{"status" => ".", "visibility" => "private"})
 119
 120       conn = get(conn, "/api/v1/timelines/home", %{"exclude_visibilities" => ["direct"]})
 121
 122       assert status_ids = json_response(conn, :ok) |> Enum.map(& &1["id"])
 123       assert public_activity.id in status_ids
 124       assert unlisted_activity.id in status_ids
 125       assert private_activity.id in status_ids
 126       refute direct_activity.id in status_ids
 127     end
 128   end
 129
 130   describe "public" do
 131     @tag capture_log: true
 132     test "the public timeline", %{conn: conn} do
 133       following = insert(:user)
 134
 135       {:ok, _activity} = CommonAPI.post(following, %{"status" => "test"})
 136
 137       _activity = insert(:note_activity, local: false)
 138
 139       conn = get(conn, "/api/v1/timelines/public", %{"local" => "False"})
 140
 141       assert length(json_response(conn, :ok)) == 2
 142
 143       conn = get(build_conn(), "/api/v1/timelines/public", %{"local" => "True"})
 144
 145       assert [%{"content" => "test"}] = json_response(conn, :ok)
 146
 147       conn = get(build_conn(), "/api/v1/timelines/public", %{"local" => "1"})
 148
 149       assert [%{"content" => "test"}] = json_response(conn, :ok)
 150     end
 151
 152     test "the public timeline includes only public statuses for an authenticated user" do
 153       %{user: user, conn: conn} = oauth_access(["read:statuses"])
 154
 155       {:ok, _activity} = CommonAPI.post(user, %{"status" => "test"})
 156       {:ok, _activity} = CommonAPI.post(user, %{"status" => "test", "visibility" => "private"})
 157       {:ok, _activity} = CommonAPI.post(user, %{"status" => "test", "visibility" => "unlisted"})
 158       {:ok, _activity} = CommonAPI.post(user, %{"status" => "test", "visibility" => "direct"})
 159
 160       res_conn = get(conn, "/api/v1/timelines/public")
 161       assert length(json_response(res_conn, 200)) == 1
 162     end
 163   end
 164
 165   defp local_and_remote_activities do
 166     insert(:note_activity)
 167     insert(:note_activity, local: false)
 168     :ok
 169   end
 170
 171   describe "public with restrict unauthenticated timeline for local and federated timelines" do
 172     setup do: local_and_remote_activities()
 173
 174     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 175
 176     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 177
 178     test "if user is unauthenticated", %{conn: conn} do
 179       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 180
 181       assert json_response(res_conn, :unauthorized) == %{
 182                "error" => "authorization required for timeline view"
 183              }
 184
 185       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 186
 187       assert json_response(res_conn, :unauthorized) == %{
 188                "error" => "authorization required for timeline view"
 189              }
 190     end
 191
 192     test "if user is authenticated" do
 193       %{conn: conn} = oauth_access(["read:statuses"])
 194
 195       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 196       assert length(json_response(res_conn, 200)) == 1
 197
 198       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 199       assert length(json_response(res_conn, 200)) == 2
 200     end
 201   end
 202
 203   describe "public with restrict unauthenticated timeline for local" do
 204     setup do: local_and_remote_activities()
 205
 206     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 207
 208     test "if user is unauthenticated", %{conn: conn} do
 209       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 210
 211       assert json_response(res_conn, :unauthorized) == %{
 212                "error" => "authorization required for timeline view"
 213              }
 214
 215       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 216       assert length(json_response(res_conn, 200)) == 2
 217     end
 218
 219     test "if user is authenticated", %{conn: _conn} do
 220       %{conn: conn} = oauth_access(["read:statuses"])
 221
 222       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 223       assert length(json_response(res_conn, 200)) == 1
 224
 225       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 226       assert length(json_response(res_conn, 200)) == 2
 227     end
 228   end
 229
 230   describe "public with restrict unauthenticated timeline for remote" do
 231     setup do: local_and_remote_activities()
 232
 233     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 234
 235     test "if user is unauthenticated", %{conn: conn} do
 236       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 237       assert length(json_response(res_conn, 200)) == 1
 238
 239       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 240
 241       assert json_response(res_conn, :unauthorized) == %{
 242                "error" => "authorization required for timeline view"
 243              }
 244     end
 245
 246     test "if user is authenticated", %{conn: _conn} do
 247       %{conn: conn} = oauth_access(["read:statuses"])
 248
 249       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
 250       assert length(json_response(res_conn, 200)) == 1
 251
 252       res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
 253       assert length(json_response(res_conn, 200)) == 2
 254     end
 255   end
 256
 257   describe "direct" do
 258     test "direct timeline", %{conn: conn} do
 259       user_one = insert(:user)
 260       user_two = insert(:user)
 261
 262       {:ok, user_two} = User.follow(user_two, user_one)
 263
 264       {:ok, direct} =
 265         CommonAPI.post(user_one, %{
 266           "status" => "Hi @#{user_two.nickname}!",
 267           "visibility" => "direct"
 268         })
 269
 270       {:ok, _follower_only} =
 271         CommonAPI.post(user_one, %{
 272           "status" => "Hi @#{user_two.nickname}!",
 273           "visibility" => "private"
 274         })
 275
 276       conn_user_two =
 277         conn
 278         |> assign(:user, user_two)
 279         |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
 280
 281       # Only direct should be visible here
 282       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 283
 284       [status] = json_response(res_conn, :ok)
 285
 286       assert %{"visibility" => "direct"} = status
 287       assert status["url"] != direct.data["id"]
 288
 289       # User should be able to see their own direct message
 290       res_conn =
 291         build_conn()
 292         |> assign(:user, user_one)
 293         |> assign(:token, insert(:oauth_token, user: user_one, scopes: ["read:statuses"]))
 294         |> get("api/v1/timelines/direct")
 295
 296       [status] = json_response(res_conn, :ok)
 297
 298       assert %{"visibility" => "direct"} = status
 299
 300       # Both should be visible here
 301       res_conn = get(conn_user_two, "api/v1/timelines/home")
 302
 303       [_s1, _s2] = json_response(res_conn, :ok)
 304
 305       # Test pagination
 306       Enum.each(1..20, fn _ ->
 307         {:ok, _} =
 308           CommonAPI.post(user_one, %{
 309             "status" => "Hi @#{user_two.nickname}!",
 310             "visibility" => "direct"
 311           })
 312       end)
 313
 314       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 315
 316       statuses = json_response(res_conn, :ok)
 317       assert length(statuses) == 20
 318
 319       res_conn =
 320         get(conn_user_two, "api/v1/timelines/direct", %{max_id: List.last(statuses)["id"]})
 321
 322       [status] = json_response(res_conn, :ok)
 323
 324       assert status["url"] != direct.data["id"]
 325     end
 326
 327     test "doesn't include DMs from blocked users" do
 328       %{user: blocker, conn: conn} = oauth_access(["read:statuses"])
 329       blocked = insert(:user)
 330       other_user = insert(:user)
 331       {:ok, _user_relationship} = User.block(blocker, blocked)
 332
 333       {:ok, _blocked_direct} =
 334         CommonAPI.post(blocked, %{
 335           "status" => "Hi @#{blocker.nickname}!",
 336           "visibility" => "direct"
 337         })
 338
 339       {:ok, direct} =
 340         CommonAPI.post(other_user, %{
 341           "status" => "Hi @#{blocker.nickname}!",
 342           "visibility" => "direct"
 343         })
 344
 345       res_conn = get(conn, "api/v1/timelines/direct")
 346
 347       [status] = json_response(res_conn, :ok)
 348       assert status["id"] == direct.id
 349     end
 350   end
 351
 352   describe "list" do
 353     setup do: oauth_access(["read:lists"])
 354
 355     test "list timeline", %{user: user, conn: conn} do
 356       other_user = insert(:user)
 357       {:ok, _activity_one} = CommonAPI.post(user, %{"status" => "Marisa is cute."})
 358       {:ok, activity_two} = CommonAPI.post(other_user, %{"status" => "Marisa is cute."})
 359       {:ok, list} = Pleroma.List.create("name", user)
 360       {:ok, list} = Pleroma.List.follow(list, other_user)
 361
 362       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 363
 364       assert [%{"id" => id}] = json_response(conn, :ok)
 365
 366       assert id == to_string(activity_two.id)
 367     end
 368
 369     test "list timeline does not leak non-public statuses for unfollowed users", %{
 370       user: user,
 371       conn: conn
 372     } do
 373       other_user = insert(:user)
 374       {:ok, activity_one} = CommonAPI.post(other_user, %{"status" => "Marisa is cute."})
 375
 376       {:ok, _activity_two} =
 377         CommonAPI.post(other_user, %{
 378           "status" => "Marisa is cute.",
 379           "visibility" => "private"
 380         })
 381
 382       {:ok, list} = Pleroma.List.create("name", user)
 383       {:ok, list} = Pleroma.List.follow(list, other_user)
 384
 385       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 386
 387       assert [%{"id" => id}] = json_response(conn, :ok)
 388
 389       assert id == to_string(activity_one.id)
 390     end
 391   end
 392
 393   describe "hashtag" do
 394     setup do: oauth_access(["n/a"])
 395
 396     @tag capture_log: true
 397     test "hashtag timeline", %{conn: conn} do
 398       following = insert(:user)
 399
 400       {:ok, activity} = CommonAPI.post(following, %{"status" => "test #2hu"})
 401
 402       nconn = get(conn, "/api/v1/timelines/tag/2hu")
 403
 404       assert [%{"id" => id}] = json_response(nconn, :ok)
 405
 406       assert id == to_string(activity.id)
 407
 408       # works for different capitalization too
 409       nconn = get(conn, "/api/v1/timelines/tag/2HU")
 410
 411       assert [%{"id" => id}] = json_response(nconn, :ok)
 412
 413       assert id == to_string(activity.id)
 414     end
 415
 416     test "multi-hashtag timeline", %{conn: conn} do
 417       user = insert(:user)
 418
 419       {:ok, activity_test} = CommonAPI.post(user, %{"status" => "#test"})
 420       {:ok, activity_test1} = CommonAPI.post(user, %{"status" => "#test #test1"})
 421       {:ok, activity_none} = CommonAPI.post(user, %{"status" => "#test #none"})
 422
 423       any_test = get(conn, "/api/v1/timelines/tag/test", %{"any" => ["test1"]})
 424
 425       [status_none, status_test1, status_test] = json_response(any_test, :ok)
 426
 427       assert to_string(activity_test.id) == status_test["id"]
 428       assert to_string(activity_test1.id) == status_test1["id"]
 429       assert to_string(activity_none.id) == status_none["id"]
 430
 431       restricted_test =
 432         get(conn, "/api/v1/timelines/tag/test", %{"all" => ["test1"], "none" => ["none"]})
 433
 434       assert [status_test1] == json_response(restricted_test, :ok)
 435
 436       all_test = get(conn, "/api/v1/timelines/tag/test", %{"all" => ["none"]})
 437
 438       assert [status_none] == json_response(all_test, :ok)
 439     end
 440   end
 441 end