1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Web.MastodonAPI.TimelineControllerTest do
6 use Pleroma.Web.ConnCase
13 alias Pleroma.Web.CommonAPI
16 mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
21 setup do: oauth_access(["read:statuses"])
23 test "does NOT embed account/pleroma/relationship in statuses", %{
27 other_user = insert(:user)
29 {:ok, _} = CommonAPI.post(other_user, %{"status" => "hi @#{user.nickname}"})
33 |> assign(:user, user)
34 |> get("/api/v1/timelines/home")
37 assert Enum.all?(response, fn n ->
38 get_in(n, ["account", "pleroma", "relationship"]) == %{}
42 test "the home timeline when the direct messages are excluded", %{user: user, conn: conn} do
43 {:ok, public_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "public"})
44 {:ok, direct_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "direct"})
46 {:ok, unlisted_activity} =
47 CommonAPI.post(user, %{"status" => ".", "visibility" => "unlisted"})
49 {:ok, private_activity} =
50 CommonAPI.post(user, %{"status" => ".", "visibility" => "private"})
52 conn = get(conn, "/api/v1/timelines/home", %{"exclude_visibilities" => ["direct"]})
54 assert status_ids = json_response(conn, :ok) |> Enum.map(& &1["id"])
55 assert public_activity.id in status_ids
56 assert unlisted_activity.id in status_ids
57 assert private_activity.id in status_ids
58 refute direct_activity.id in status_ids
63 @tag capture_log: true
64 test "the public timeline", %{conn: conn} do
65 following = insert(:user)
67 {:ok, _activity} = CommonAPI.post(following, %{"status" => "test"})
69 _activity = insert(:note_activity, local: false)
71 conn = get(conn, "/api/v1/timelines/public", %{"local" => "False"})
73 assert length(json_response(conn, :ok)) == 2
75 conn = get(build_conn(), "/api/v1/timelines/public", %{"local" => "True"})
77 assert [%{"content" => "test"}] = json_response(conn, :ok)
79 conn = get(build_conn(), "/api/v1/timelines/public", %{"local" => "1"})
81 assert [%{"content" => "test"}] = json_response(conn, :ok)
84 test "the public timeline includes only public statuses for an authenticated user" do
85 %{user: user, conn: conn} = oauth_access(["read:statuses"])
87 {:ok, _activity} = CommonAPI.post(user, %{"status" => "test"})
88 {:ok, _activity} = CommonAPI.post(user, %{"status" => "test", "visibility" => "private"})
89 {:ok, _activity} = CommonAPI.post(user, %{"status" => "test", "visibility" => "unlisted"})
90 {:ok, _activity} = CommonAPI.post(user, %{"status" => "test", "visibility" => "direct"})
92 res_conn = get(conn, "/api/v1/timelines/public")
93 assert length(json_response(res_conn, 200)) == 1
97 defp local_and_remote_activities do
98 insert(:note_activity)
99 insert(:note_activity, local: false)
103 describe "public with restrict unauthenticated timeline for local and federated timelines" do
104 setup do: local_and_remote_activities()
106 setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
108 setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
110 test "if user is unauthenticated", %{conn: conn} do
111 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
113 assert json_response(res_conn, :unauthorized) == %{
114 "error" => "authorization required for timeline view"
117 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
119 assert json_response(res_conn, :unauthorized) == %{
120 "error" => "authorization required for timeline view"
124 test "if user is authenticated" do
125 %{conn: conn} = oauth_access(["read:statuses"])
127 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
128 assert length(json_response(res_conn, 200)) == 1
130 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
131 assert length(json_response(res_conn, 200)) == 2
135 describe "public with restrict unauthenticated timeline for local" do
136 setup do: local_and_remote_activities()
138 setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
140 test "if user is unauthenticated", %{conn: conn} do
141 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
143 assert json_response(res_conn, :unauthorized) == %{
144 "error" => "authorization required for timeline view"
147 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
148 assert length(json_response(res_conn, 200)) == 2
151 test "if user is authenticated", %{conn: _conn} do
152 %{conn: conn} = oauth_access(["read:statuses"])
154 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
155 assert length(json_response(res_conn, 200)) == 1
157 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
158 assert length(json_response(res_conn, 200)) == 2
162 describe "public with restrict unauthenticated timeline for remote" do
163 setup do: local_and_remote_activities()
165 setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
167 test "if user is unauthenticated", %{conn: conn} do
168 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
169 assert length(json_response(res_conn, 200)) == 1
171 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
173 assert json_response(res_conn, :unauthorized) == %{
174 "error" => "authorization required for timeline view"
178 test "if user is authenticated", %{conn: _conn} do
179 %{conn: conn} = oauth_access(["read:statuses"])
181 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
182 assert length(json_response(res_conn, 200)) == 1
184 res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
185 assert length(json_response(res_conn, 200)) == 2
190 test "direct timeline", %{conn: conn} do
191 user_one = insert(:user)
192 user_two = insert(:user)
194 {:ok, user_two} = User.follow(user_two, user_one)
197 CommonAPI.post(user_one, %{
198 "status" => "Hi @#{user_two.nickname}!",
199 "visibility" => "direct"
202 {:ok, _follower_only} =
203 CommonAPI.post(user_one, %{
204 "status" => "Hi @#{user_two.nickname}!",
205 "visibility" => "private"
210 |> assign(:user, user_two)
211 |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
213 # Only direct should be visible here
214 res_conn = get(conn_user_two, "api/v1/timelines/direct")
216 [status] = json_response(res_conn, :ok)
218 assert %{"visibility" => "direct"} = status
219 assert status["url"] != direct.data["id"]
221 # User should be able to see their own direct message
224 |> assign(:user, user_one)
225 |> assign(:token, insert(:oauth_token, user: user_one, scopes: ["read:statuses"]))
226 |> get("api/v1/timelines/direct")
228 [status] = json_response(res_conn, :ok)
230 assert %{"visibility" => "direct"} = status
232 # Both should be visible here
233 res_conn = get(conn_user_two, "api/v1/timelines/home")
235 [_s1, _s2] = json_response(res_conn, :ok)
238 Enum.each(1..20, fn _ ->
240 CommonAPI.post(user_one, %{
241 "status" => "Hi @#{user_two.nickname}!",
242 "visibility" => "direct"
246 res_conn = get(conn_user_two, "api/v1/timelines/direct")
248 statuses = json_response(res_conn, :ok)
249 assert length(statuses) == 20
252 get(conn_user_two, "api/v1/timelines/direct", %{max_id: List.last(statuses)["id"]})
254 [status] = json_response(res_conn, :ok)
256 assert status["url"] != direct.data["id"]
259 test "doesn't include DMs from blocked users" do
260 %{user: blocker, conn: conn} = oauth_access(["read:statuses"])
261 blocked = insert(:user)
262 other_user = insert(:user)
263 {:ok, _user_relationship} = User.block(blocker, blocked)
265 {:ok, _blocked_direct} =
266 CommonAPI.post(blocked, %{
267 "status" => "Hi @#{blocker.nickname}!",
268 "visibility" => "direct"
272 CommonAPI.post(other_user, %{
273 "status" => "Hi @#{blocker.nickname}!",
274 "visibility" => "direct"
277 res_conn = get(conn, "api/v1/timelines/direct")
279 [status] = json_response(res_conn, :ok)
280 assert status["id"] == direct.id
285 setup do: oauth_access(["read:lists"])
287 test "list timeline", %{user: user, conn: conn} do
288 other_user = insert(:user)
289 {:ok, _activity_one} = CommonAPI.post(user, %{"status" => "Marisa is cute."})
290 {:ok, activity_two} = CommonAPI.post(other_user, %{"status" => "Marisa is cute."})
291 {:ok, list} = Pleroma.List.create("name", user)
292 {:ok, list} = Pleroma.List.follow(list, other_user)
294 conn = get(conn, "/api/v1/timelines/list/#{list.id}")
296 assert [%{"id" => id}] = json_response(conn, :ok)
298 assert id == to_string(activity_two.id)
301 test "list timeline does not leak non-public statuses for unfollowed users", %{
305 other_user = insert(:user)
306 {:ok, activity_one} = CommonAPI.post(other_user, %{"status" => "Marisa is cute."})
308 {:ok, _activity_two} =
309 CommonAPI.post(other_user, %{
310 "status" => "Marisa is cute.",
311 "visibility" => "private"
314 {:ok, list} = Pleroma.List.create("name", user)
315 {:ok, list} = Pleroma.List.follow(list, other_user)
317 conn = get(conn, "/api/v1/timelines/list/#{list.id}")
319 assert [%{"id" => id}] = json_response(conn, :ok)
321 assert id == to_string(activity_one.id)
325 describe "hashtag" do
326 setup do: oauth_access(["n/a"])
328 @tag capture_log: true
329 test "hashtag timeline", %{conn: conn} do
330 following = insert(:user)
332 {:ok, activity} = CommonAPI.post(following, %{"status" => "test #2hu"})
334 nconn = get(conn, "/api/v1/timelines/tag/2hu")
336 assert [%{"id" => id}] = json_response(nconn, :ok)
338 assert id == to_string(activity.id)
340 # works for different capitalization too
341 nconn = get(conn, "/api/v1/timelines/tag/2HU")
343 assert [%{"id" => id}] = json_response(nconn, :ok)
345 assert id == to_string(activity.id)
348 test "multi-hashtag timeline", %{conn: conn} do
351 {:ok, activity_test} = CommonAPI.post(user, %{"status" => "#test"})
352 {:ok, activity_test1} = CommonAPI.post(user, %{"status" => "#test #test1"})
353 {:ok, activity_none} = CommonAPI.post(user, %{"status" => "#test #none"})
355 any_test = get(conn, "/api/v1/timelines/tag/test", %{"any" => ["test1"]})
357 [status_none, status_test1, status_test] = json_response(any_test, :ok)
359 assert to_string(activity_test.id) == status_test["id"]
360 assert to_string(activity_test1.id) == status_test1["id"]
361 assert to_string(activity_none.id) == status_none["id"]
364 get(conn, "/api/v1/timelines/tag/test", %{"all" => ["test1"], "none" => ["none"]})
366 assert [status_test1] == json_response(restricted_test, :ok)
368 all_test = get(conn, "/api/v1/timelines/tag/test", %{"all" => ["none"]})
370 assert [status_none] == json_response(all_test, :ok)