a49ab002fcb665754d1741c0430ed9f08b461648
[akkoma] / test / web / static_fe / static_fe_controller_test.exs
1 defmodule Pleroma.Web.StaticFE.StaticFEControllerTest do
2 use Pleroma.Web.ConnCase
3
4 alias Pleroma.Activity
5 alias Pleroma.Config
6 alias Pleroma.Web.ActivityPub.Transmogrifier
7 alias Pleroma.Web.CommonAPI
8
9 import Pleroma.Factory
10
11 setup_all do: clear_config([:static_fe, :enabled], true)
12 setup do: clear_config([:instance, :federating], true)
13
14 setup %{conn: conn} do
15 conn = put_req_header(conn, "accept", "text/html")
16 user = insert(:user)
17
18 %{conn: conn, user: user}
19 end
20
21 describe "user profile html" do
22 test "just the profile as HTML", %{conn: conn, user: user} do
23 conn = get(conn, "/users/#{user.nickname}")
24
25 assert html_response(conn, 200) =~ user.nickname
26 end
27
28 test "404 when user not found", %{conn: conn} do
29 conn = get(conn, "/users/limpopo")
30
31 assert html_response(conn, 404) =~ "not found"
32 end
33
34 test "profile does not include private messages", %{conn: conn, user: user} do
35 CommonAPI.post(user, %{status: "public"})
36 CommonAPI.post(user, %{status: "private", visibility: "private"})
37
38 conn = get(conn, "/users/#{user.nickname}")
39
40 html = html_response(conn, 200)
41
42 assert html =~ ">public<"
43 refute html =~ ">private<"
44 end
45
46 test "pagination", %{conn: conn, user: user} do
47 Enum.map(1..30, fn i -> CommonAPI.post(user, %{status: "test#{i}"}) end)
48
49 conn = get(conn, "/users/#{user.nickname}")
50
51 html = html_response(conn, 200)
52
53 assert html =~ ">test30<"
54 assert html =~ ">test11<"
55 refute html =~ ">test10<"
56 refute html =~ ">test1<"
57 end
58
59 test "pagination, page 2", %{conn: conn, user: user} do
60 activities = Enum.map(1..30, fn i -> CommonAPI.post(user, %{status: "test#{i}"}) end)
61 {:ok, a11} = Enum.at(activities, 11)
62
63 conn = get(conn, "/users/#{user.nickname}?max_id=#{a11.id}")
64
65 html = html_response(conn, 200)
66
67 assert html =~ ">test1<"
68 assert html =~ ">test10<"
69 refute html =~ ">test20<"
70 refute html =~ ">test29<"
71 end
72
73 test "it requires authentication if instance is NOT federating", %{conn: conn, user: user} do
74 ensure_federating_or_authenticated(conn, "/users/#{user.nickname}", user)
75 end
76 end
77
78 describe "notice html" do
79 test "single notice page", %{conn: conn, user: user} do
80 {:ok, activity} = CommonAPI.post(user, %{status: "testing a thing!"})
81
82 conn = get(conn, "/notice/#{activity.id}")
83
84 html = html_response(conn, 200)
85 assert html =~ "<header>"
86 assert html =~ user.nickname
87 assert html =~ "testing a thing!"
88 end
89
90 test "filters HTML tags", %{conn: conn} do
91 user = insert(:user)
92 {:ok, activity} = CommonAPI.post(user, %{status: "<script>alert('xss')</script>"})
93
94 conn =
95 conn
96 |> put_req_header("accept", "text/html")
97 |> get("/notice/#{activity.id}")
98
99 html = html_response(conn, 200)
100 assert html =~ ~s[&lt;script&gt;alert(&#39;xss&#39;)&lt;/script&gt;]
101 end
102
103 test "shows the whole thread", %{conn: conn, user: user} do
104 {:ok, activity} = CommonAPI.post(user, %{status: "space: the final frontier"})
105
106 CommonAPI.post(user, %{
107 status: "these are the voyages or something",
108 in_reply_to_status_id: activity.id
109 })
110
111 conn = get(conn, "/notice/#{activity.id}")
112
113 html = html_response(conn, 200)
114 assert html =~ "the final frontier"
115 assert html =~ "voyages"
116 end
117
118 test "redirect by AP object ID", %{conn: conn, user: user} do
119 {:ok, %Activity{data: %{"object" => object_url}}} =
120 CommonAPI.post(user, %{status: "beam me up"})
121
122 conn = get(conn, URI.parse(object_url).path)
123
124 assert html_response(conn, 302) =~ "redirected"
125 end
126
127 test "redirect by activity ID", %{conn: conn, user: user} do
128 {:ok, %Activity{data: %{"id" => id}}} =
129 CommonAPI.post(user, %{status: "I'm a doctor, not a devops!"})
130
131 conn = get(conn, URI.parse(id).path)
132
133 assert html_response(conn, 302) =~ "redirected"
134 end
135
136 test "404 when notice not found", %{conn: conn} do
137 conn = get(conn, "/notice/88c9c317")
138
139 assert html_response(conn, 404) =~ "not found"
140 end
141
142 test "404 for private status", %{conn: conn, user: user} do
143 {:ok, activity} = CommonAPI.post(user, %{status: "don't show me!", visibility: "private"})
144
145 conn = get(conn, "/notice/#{activity.id}")
146
147 assert html_response(conn, 404) =~ "not found"
148 end
149
150 test "302 for remote cached status", %{conn: conn, user: user} do
151 message = %{
152 "@context" => "https://www.w3.org/ns/activitystreams",
153 "to" => user.follower_address,
154 "cc" => "https://www.w3.org/ns/activitystreams#Public",
155 "type" => "Create",
156 "object" => %{
157 "content" => "blah blah blah",
158 "type" => "Note",
159 "attributedTo" => user.ap_id,
160 "inReplyTo" => nil
161 },
162 "actor" => user.ap_id
163 }
164
165 assert {:ok, activity} = Transmogrifier.handle_incoming(message)
166
167 conn = get(conn, "/notice/#{activity.id}")
168
169 assert html_response(conn, 302) =~ "redirected"
170 end
171
172 test "it requires authentication if instance is NOT federating", %{conn: conn, user: user} do
173 {:ok, activity} = CommonAPI.post(user, %{status: "testing a thing!"})
174
175 ensure_federating_or_authenticated(conn, "/notice/#{activity.id}", user)
176 end
177 end
178 end