git.squeep.com Git - akkoma/blob - test/web/twitter_api/twitter_api_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.TwitterAPI.ControllerTest do
   6   use Pleroma.Web.ConnCase
   7   alias Pleroma.Web.TwitterAPI.Representers.ActivityRepresenter
   8   alias Pleroma.Builders.{ActivityBuilder, UserBuilder}
   9   alias Pleroma.{Repo, Activity, User, Object, Notification}
  10   alias Pleroma.Web.ActivityPub.ActivityPub
  11   alias Pleroma.Web.TwitterAPI.UserView
  12   alias Pleroma.Web.TwitterAPI.NotificationView
  13   alias Pleroma.Web.CommonAPI
  14   alias Pleroma.Web.TwitterAPI.TwitterAPI
  15   alias Comeonin.Pbkdf2
  16   alias Ecto.Changeset
  17
  18   import Pleroma.Factory
  19
  20   @banner "data:image/gif;base64,R0lGODlhEAAQAMQAAORHHOVSKudfOulrSOp3WOyDZu6QdvCchPGolfO0o/XBs/fNwfjZ0frl3/zy7////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAkAABAALAAAAAAQABAAAAVVICSOZGlCQAosJ6mu7fiyZeKqNKToQGDsM8hBADgUXoGAiqhSvp5QAnQKGIgUhwFUYLCVDFCrKUE1lBavAViFIDlTImbKC5Gm2hB0SlBCBMQiB0UjIQA7"
  21
  22   describe "POST /api/account/update_profile_banner" do
  23     test "it updates the banner", %{conn: conn} do
  24       user = insert(:user)
  25
  26       conn
  27       |> assign(:user, user)
  28       |> post(authenticated_twitter_api__path(conn, :update_banner), %{"banner" => @banner})
  29       |> json_response(200)
  30
  31       user = refresh_record(user)
  32       assert user.info.banner["type"] == "Image"
  33     end
  34   end
  35
  36   describe "POST /api/qvitter/update_background_image" do
  37     test "it updates the background", %{conn: conn} do
  38       user = insert(:user)
  39
  40       conn
  41       |> assign(:user, user)
  42       |> post(authenticated_twitter_api__path(conn, :update_background), %{"img" => @banner})
  43       |> json_response(200)
  44
  45       user = refresh_record(user)
  46       assert user.info.background["type"] == "Image"
  47     end
  48   end
  49
  50   describe "POST /api/account/verify_credentials" do
  51     setup [:valid_user]
  52
  53     test "without valid credentials", %{conn: conn} do
  54       conn = post(conn, "/api/account/verify_credentials.json")
  55       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
  56     end
  57
  58     test "with credentials", %{conn: conn, user: user} do
  59       response =
  60         conn
  61         |> with_credentials(user.nickname, "test")
  62         |> post("/api/account/verify_credentials.json")
  63         |> json_response(200)
  64
  65       assert response == UserView.render("show.json", %{user: user, token: response["token"]})
  66     end
  67   end
  68
  69   describe "POST /statuses/update.json" do
  70     setup [:valid_user]
  71
  72     test "without valid credentials", %{conn: conn} do
  73       conn = post(conn, "/api/statuses/update.json")
  74       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
  75     end
  76
  77     test "with credentials", %{conn: conn, user: user} do
  78       conn_with_creds = conn |> with_credentials(user.nickname, "test")
  79       request_path = "/api/statuses/update.json"
  80
  81       error_response = %{
  82         "request" => request_path,
  83         "error" => "Client must provide a 'status' parameter with a value."
  84       }
  85
  86       conn =
  87         conn_with_creds
  88         |> post(request_path)
  89
  90       assert json_response(conn, 400) == error_response
  91
  92       conn =
  93         conn_with_creds
  94         |> post(request_path, %{status: ""})
  95
  96       assert json_response(conn, 400) == error_response
  97
  98       conn =
  99         conn_with_creds
 100         |> post(request_path, %{status: " "})
 101
 102       assert json_response(conn, 400) == error_response
 103
 104       # we post with visibility private in order to avoid triggering relay
 105       conn =
 106         conn_with_creds
 107         |> post(request_path, %{status: "Nice meme.", visibility: "private"})
 108
 109       assert json_response(conn, 200) ==
 110                ActivityRepresenter.to_map(Repo.one(Activity), %{user: user})
 111     end
 112   end
 113
 114   describe "GET /statuses/public_timeline.json" do
 115     test "returns statuses", %{conn: conn} do
 116       user = insert(:user)
 117       activities = ActivityBuilder.insert_list(30, %{}, %{user: user})
 118       ActivityBuilder.insert_list(10, %{}, %{user: user})
 119       since_id = List.last(activities).id
 120
 121       conn =
 122         conn
 123         |> get("/api/statuses/public_timeline.json", %{since_id: since_id})
 124
 125       response = json_response(conn, 200)
 126
 127       assert length(response) == 10
 128     end
 129
 130     test "returns 403 to unauthenticated request when the instance is not public", %{conn: conn} do
 131       instance =
 132         Application.get_env(:pleroma, :instance)
 133         |> Keyword.put(:public, false)
 134
 135       Application.put_env(:pleroma, :instance, instance)
 136
 137       conn
 138       |> get("/api/statuses/public_timeline.json")
 139       |> json_response(403)
 140
 141       instance =
 142         Application.get_env(:pleroma, :instance)
 143         |> Keyword.put(:public, true)
 144
 145       Application.put_env(:pleroma, :instance, instance)
 146     end
 147
 148     test "returns 200 to unauthenticated request when the instance is public", %{conn: conn} do
 149       conn
 150       |> get("/api/statuses/public_timeline.json")
 151       |> json_response(200)
 152     end
 153   end
 154
 155   describe "GET /statuses/public_and_external_timeline.json" do
 156     test "returns 403 to unauthenticated request when the instance is not public", %{conn: conn} do
 157       instance =
 158         Application.get_env(:pleroma, :instance)
 159         |> Keyword.put(:public, false)
 160
 161       Application.put_env(:pleroma, :instance, instance)
 162
 163       conn
 164       |> get("/api/statuses/public_and_external_timeline.json")
 165       |> json_response(403)
 166
 167       instance =
 168         Application.get_env(:pleroma, :instance)
 169         |> Keyword.put(:public, true)
 170
 171       Application.put_env(:pleroma, :instance, instance)
 172     end
 173
 174     test "returns 200 to unauthenticated request when the instance is public", %{conn: conn} do
 175       conn
 176       |> get("/api/statuses/public_and_external_timeline.json")
 177       |> json_response(200)
 178     end
 179   end
 180
 181   describe "GET /statuses/show/:id.json" do
 182     test "returns one status", %{conn: conn} do
 183       user = insert(:user)
 184       {:ok, activity} = CommonAPI.post(user, %{"status" => "Hey!"})
 185       actor = Repo.get_by!(User, ap_id: activity.data["actor"])
 186
 187       conn =
 188         conn
 189         |> get("/api/statuses/show/#{activity.id}.json")
 190
 191       response = json_response(conn, 200)
 192
 193       assert response == ActivityRepresenter.to_map(activity, %{user: actor})
 194     end
 195   end
 196
 197   describe "GET /users/show.json" do
 198     test "gets user with screen_name", %{conn: conn} do
 199       user = insert(:user)
 200
 201       conn =
 202         conn
 203         |> get("/api/users/show.json", %{"screen_name" => user.nickname})
 204
 205       response = json_response(conn, 200)
 206
 207       assert response["id"] == user.id
 208     end
 209
 210     test "gets user with user_id", %{conn: conn} do
 211       user = insert(:user)
 212
 213       conn =
 214         conn
 215         |> get("/api/users/show.json", %{"user_id" => user.id})
 216
 217       response = json_response(conn, 200)
 218
 219       assert response["id"] == user.id
 220     end
 221
 222     test "gets a user for a logged in user", %{conn: conn} do
 223       user = insert(:user)
 224       logged_in = insert(:user)
 225
 226       {:ok, logged_in, user, _activity} = TwitterAPI.follow(logged_in, %{"user_id" => user.id})
 227
 228       conn =
 229         conn
 230         |> with_credentials(logged_in.nickname, "test")
 231         |> get("/api/users/show.json", %{"user_id" => user.id})
 232
 233       response = json_response(conn, 200)
 234
 235       assert response["following"] == true
 236     end
 237   end
 238
 239   describe "GET /statusnet/conversation/:id.json" do
 240     test "returns the statuses in the conversation", %{conn: conn} do
 241       {:ok, _user} = UserBuilder.insert()
 242       {:ok, activity} = ActivityBuilder.insert(%{"type" => "Create", "context" => "2hu"})
 243       {:ok, _activity_two} = ActivityBuilder.insert(%{"type" => "Create", "context" => "2hu"})
 244       {:ok, _activity_three} = ActivityBuilder.insert(%{"type" => "Create", "context" => "3hu"})
 245
 246       conn =
 247         conn
 248         |> get("/api/statusnet/conversation/#{activity.data["context_id"]}.json")
 249
 250       response = json_response(conn, 200)
 251
 252       assert length(response) == 2
 253     end
 254   end
 255
 256   describe "GET /statuses/friends_timeline.json" do
 257     setup [:valid_user]
 258
 259     test "without valid credentials", %{conn: conn} do
 260       conn = get(conn, "/api/statuses/friends_timeline.json")
 261       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 262     end
 263
 264     test "with credentials", %{conn: conn, user: current_user} do
 265       user = insert(:user)
 266
 267       activities =
 268         ActivityBuilder.insert_list(30, %{"to" => [User.ap_followers(user)]}, %{user: user})
 269
 270       returned_activities =
 271         ActivityBuilder.insert_list(10, %{"to" => [User.ap_followers(user)]}, %{user: user})
 272
 273       other_user = insert(:user)
 274       ActivityBuilder.insert_list(10, %{}, %{user: other_user})
 275       since_id = List.last(activities).id
 276
 277       current_user =
 278         Changeset.change(current_user, following: [User.ap_followers(user)])
 279         |> Repo.update!()
 280
 281       conn =
 282         conn
 283         |> with_credentials(current_user.nickname, "test")
 284         |> get("/api/statuses/friends_timeline.json", %{since_id: since_id})
 285
 286       response = json_response(conn, 200)
 287
 288       assert length(response) == 10
 289
 290       assert response ==
 291                Enum.map(returned_activities, fn activity ->
 292                  ActivityRepresenter.to_map(activity, %{
 293                    user: User.get_cached_by_ap_id(activity.data["actor"]),
 294                    for: current_user
 295                  })
 296                end)
 297     end
 298   end
 299
 300   describe "GET /statuses/dm_timeline.json" do
 301     test "it show direct messages", %{conn: conn} do
 302       user_one = insert(:user)
 303       user_two = insert(:user)
 304
 305       {:ok, user_two} = User.follow(user_two, user_one)
 306
 307       {:ok, direct} =
 308         CommonAPI.post(user_one, %{
 309           "status" => "Hi @#{user_two.nickname}!",
 310           "visibility" => "direct"
 311         })
 312
 313       {:ok, direct_two} =
 314         CommonAPI.post(user_two, %{
 315           "status" => "Hi @#{user_one.nickname}!",
 316           "visibility" => "direct"
 317         })
 318
 319       {:ok, _follower_only} =
 320         CommonAPI.post(user_one, %{
 321           "status" => "Hi @#{user_two.nickname}!",
 322           "visibility" => "private"
 323         })
 324
 325       # Only direct should be visible here
 326       res_conn =
 327         conn
 328         |> assign(:user, user_two)
 329         |> get("/api/statuses/dm_timeline.json")
 330
 331       [status, status_two] = json_response(res_conn, 200)
 332       assert status["id"] == direct_two.id
 333       assert status_two["id"] == direct.id
 334     end
 335   end
 336
 337   describe "GET /statuses/mentions.json" do
 338     setup [:valid_user]
 339
 340     test "without valid credentials", %{conn: conn} do
 341       conn = get(conn, "/api/statuses/mentions.json")
 342       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 343     end
 344
 345     test "with credentials", %{conn: conn, user: current_user} do
 346       {:ok, activity} =
 347         ActivityBuilder.insert(%{"to" => [current_user.ap_id]}, %{user: current_user})
 348
 349       conn =
 350         conn
 351         |> with_credentials(current_user.nickname, "test")
 352         |> get("/api/statuses/mentions.json")
 353
 354       response = json_response(conn, 200)
 355
 356       assert length(response) == 1
 357
 358       assert Enum.at(response, 0) ==
 359                ActivityRepresenter.to_map(activity, %{
 360                  user: current_user,
 361                  mentioned: [current_user]
 362                })
 363     end
 364   end
 365
 366   describe "GET /api/qvitter/statuses/notifications.json" do
 367     setup [:valid_user]
 368
 369     test "without valid credentials", %{conn: conn} do
 370       conn = get(conn, "/api/qvitter/statuses/notifications.json")
 371       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 372     end
 373
 374     test "with credentials", %{conn: conn, user: current_user} do
 375       other_user = insert(:user)
 376
 377       {:ok, _activity} =
 378         ActivityBuilder.insert(%{"to" => [current_user.ap_id]}, %{user: other_user})
 379
 380       conn =
 381         conn
 382         |> with_credentials(current_user.nickname, "test")
 383         |> get("/api/qvitter/statuses/notifications.json")
 384
 385       response = json_response(conn, 200)
 386
 387       assert length(response) == 1
 388
 389       assert response ==
 390                NotificationView.render("notification.json", %{
 391                  notifications: Notification.for_user(current_user),
 392                  for: current_user
 393                })
 394     end
 395   end
 396
 397   describe "POST /api/qvitter/statuses/notifications/read" do
 398     setup [:valid_user]
 399
 400     test "without valid credentials", %{conn: conn} do
 401       conn = post(conn, "/api/qvitter/statuses/notifications/read", %{"latest_id" => 1_234_567})
 402       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 403     end
 404
 405     test "with credentials, without any params", %{conn: conn, user: current_user} do
 406       conn =
 407         conn
 408         |> with_credentials(current_user.nickname, "test")
 409         |> post("/api/qvitter/statuses/notifications/read")
 410
 411       assert json_response(conn, 400) == %{
 412                "error" => "You need to specify latest_id",
 413                "request" => "/api/qvitter/statuses/notifications/read"
 414              }
 415     end
 416
 417     test "with credentials, with params", %{conn: conn, user: current_user} do
 418       other_user = insert(:user)
 419
 420       {:ok, _activity} =
 421         ActivityBuilder.insert(%{"to" => [current_user.ap_id]}, %{user: other_user})
 422
 423       response_conn =
 424         conn
 425         |> with_credentials(current_user.nickname, "test")
 426         |> get("/api/qvitter/statuses/notifications.json")
 427
 428       [notification] = response = json_response(response_conn, 200)
 429
 430       assert length(response) == 1
 431
 432       assert notification["is_seen"] == 0
 433
 434       response_conn =
 435         conn
 436         |> with_credentials(current_user.nickname, "test")
 437         |> post("/api/qvitter/statuses/notifications/read", %{"latest_id" => notification["id"]})
 438
 439       [notification] = response = json_response(response_conn, 200)
 440
 441       assert length(response) == 1
 442
 443       assert notification["is_seen"] == 1
 444     end
 445   end
 446
 447   describe "GET /statuses/user_timeline.json" do
 448     setup [:valid_user]
 449
 450     test "without any params", %{conn: conn} do
 451       conn = get(conn, "/api/statuses/user_timeline.json")
 452
 453       assert json_response(conn, 400) == %{
 454                "error" => "You need to specify screen_name or user_id",
 455                "request" => "/api/statuses/user_timeline.json"
 456              }
 457     end
 458
 459     test "with user_id", %{conn: conn} do
 460       user = insert(:user)
 461       {:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: user})
 462
 463       conn = get(conn, "/api/statuses/user_timeline.json", %{"user_id" => user.id})
 464       response = json_response(conn, 200)
 465       assert length(response) == 1
 466       assert Enum.at(response, 0) == ActivityRepresenter.to_map(activity, %{user: user})
 467     end
 468
 469     test "with screen_name", %{conn: conn} do
 470       user = insert(:user)
 471       {:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: user})
 472
 473       conn = get(conn, "/api/statuses/user_timeline.json", %{"screen_name" => user.nickname})
 474       response = json_response(conn, 200)
 475       assert length(response) == 1
 476       assert Enum.at(response, 0) == ActivityRepresenter.to_map(activity, %{user: user})
 477     end
 478
 479     test "with credentials", %{conn: conn, user: current_user} do
 480       {:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: current_user})
 481
 482       conn =
 483         conn
 484         |> with_credentials(current_user.nickname, "test")
 485         |> get("/api/statuses/user_timeline.json")
 486
 487       response = json_response(conn, 200)
 488
 489       assert length(response) == 1
 490       assert Enum.at(response, 0) == ActivityRepresenter.to_map(activity, %{user: current_user})
 491     end
 492
 493     test "with credentials with user_id", %{conn: conn, user: current_user} do
 494       user = insert(:user)
 495       {:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: user})
 496
 497       conn =
 498         conn
 499         |> with_credentials(current_user.nickname, "test")
 500         |> get("/api/statuses/user_timeline.json", %{"user_id" => user.id})
 501
 502       response = json_response(conn, 200)
 503
 504       assert length(response) == 1
 505       assert Enum.at(response, 0) == ActivityRepresenter.to_map(activity, %{user: user})
 506     end
 507
 508     test "with credentials screen_name", %{conn: conn, user: current_user} do
 509       user = insert(:user)
 510       {:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: user})
 511
 512       conn =
 513         conn
 514         |> with_credentials(current_user.nickname, "test")
 515         |> get("/api/statuses/user_timeline.json", %{"screen_name" => user.nickname})
 516
 517       response = json_response(conn, 200)
 518
 519       assert length(response) == 1
 520       assert Enum.at(response, 0) == ActivityRepresenter.to_map(activity, %{user: user})
 521     end
 522   end
 523
 524   describe "POST /friendships/create.json" do
 525     setup [:valid_user]
 526
 527     test "without valid credentials", %{conn: conn} do
 528       conn = post(conn, "/api/friendships/create.json")
 529       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 530     end
 531
 532     test "with credentials", %{conn: conn, user: current_user} do
 533       followed = insert(:user)
 534
 535       conn =
 536         conn
 537         |> with_credentials(current_user.nickname, "test")
 538         |> post("/api/friendships/create.json", %{user_id: followed.id})
 539
 540       current_user = Repo.get(User, current_user.id)
 541       assert User.ap_followers(followed) in current_user.following
 542
 543       assert json_response(conn, 200) ==
 544                UserView.render("show.json", %{user: followed, for: current_user})
 545     end
 546   end
 547
 548   describe "POST /friendships/destroy.json" do
 549     setup [:valid_user]
 550
 551     test "without valid credentials", %{conn: conn} do
 552       conn = post(conn, "/api/friendships/destroy.json")
 553       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 554     end
 555
 556     test "with credentials", %{conn: conn, user: current_user} do
 557       followed = insert(:user)
 558
 559       {:ok, current_user} = User.follow(current_user, followed)
 560       assert User.ap_followers(followed) in current_user.following
 561       ActivityPub.follow(current_user, followed)
 562
 563       conn =
 564         conn
 565         |> with_credentials(current_user.nickname, "test")
 566         |> post("/api/friendships/destroy.json", %{user_id: followed.id})
 567
 568       current_user = Repo.get(User, current_user.id)
 569       assert current_user.following == [current_user.ap_id]
 570
 571       assert json_response(conn, 200) ==
 572                UserView.render("show.json", %{user: followed, for: current_user})
 573     end
 574   end
 575
 576   describe "POST /blocks/create.json" do
 577     setup [:valid_user]
 578
 579     test "without valid credentials", %{conn: conn} do
 580       conn = post(conn, "/api/blocks/create.json")
 581       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 582     end
 583
 584     test "with credentials", %{conn: conn, user: current_user} do
 585       blocked = insert(:user)
 586
 587       conn =
 588         conn
 589         |> with_credentials(current_user.nickname, "test")
 590         |> post("/api/blocks/create.json", %{user_id: blocked.id})
 591
 592       current_user = Repo.get(User, current_user.id)
 593       assert User.blocks?(current_user, blocked)
 594
 595       assert json_response(conn, 200) ==
 596                UserView.render("show.json", %{user: blocked, for: current_user})
 597     end
 598   end
 599
 600   describe "POST /blocks/destroy.json" do
 601     setup [:valid_user]
 602
 603     test "without valid credentials", %{conn: conn} do
 604       conn = post(conn, "/api/blocks/destroy.json")
 605       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 606     end
 607
 608     test "with credentials", %{conn: conn, user: current_user} do
 609       blocked = insert(:user)
 610
 611       {:ok, current_user, blocked} = TwitterAPI.block(current_user, %{"user_id" => blocked.id})
 612       assert User.blocks?(current_user, blocked)
 613
 614       conn =
 615         conn
 616         |> with_credentials(current_user.nickname, "test")
 617         |> post("/api/blocks/destroy.json", %{user_id: blocked.id})
 618
 619       current_user = Repo.get(User, current_user.id)
 620       assert current_user.info.blocks == []
 621
 622       assert json_response(conn, 200) ==
 623                UserView.render("show.json", %{user: blocked, for: current_user})
 624     end
 625   end
 626
 627   describe "GET /help/test.json" do
 628     test "returns \"ok\"", %{conn: conn} do
 629       conn = get(conn, "/api/help/test.json")
 630       assert json_response(conn, 200) == "ok"
 631     end
 632   end
 633
 634   describe "POST /api/qvitter/update_avatar.json" do
 635     setup [:valid_user]
 636
 637     test "without valid credentials", %{conn: conn} do
 638       conn = post(conn, "/api/qvitter/update_avatar.json")
 639       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 640     end
 641
 642     test "with credentials", %{conn: conn, user: current_user} do
 643       avatar_image = File.read!("test/fixtures/avatar_data_uri")
 644
 645       conn =
 646         conn
 647         |> with_credentials(current_user.nickname, "test")
 648         |> post("/api/qvitter/update_avatar.json", %{img: avatar_image})
 649
 650       current_user = Repo.get(User, current_user.id)
 651       assert is_map(current_user.avatar)
 652
 653       assert json_response(conn, 200) ==
 654                UserView.render("show.json", %{user: current_user, for: current_user})
 655     end
 656   end
 657
 658   describe "GET /api/qvitter/mutes.json" do
 659     setup [:valid_user]
 660
 661     test "unimplemented mutes without valid credentials", %{conn: conn} do
 662       conn = get(conn, "/api/qvitter/mutes.json")
 663       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 664     end
 665
 666     test "unimplemented mutes with credentials", %{conn: conn, user: current_user} do
 667       response =
 668         conn
 669         |> with_credentials(current_user.nickname, "test")
 670         |> get("/api/qvitter/mutes.json")
 671         |> json_response(200)
 672
 673       assert [] = response
 674     end
 675   end
 676
 677   describe "POST /api/favorites/create/:id" do
 678     setup [:valid_user]
 679
 680     test "without valid credentials", %{conn: conn} do
 681       note_activity = insert(:note_activity)
 682       conn = post(conn, "/api/favorites/create/#{note_activity.id}.json")
 683       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 684     end
 685
 686     test "with credentials", %{conn: conn, user: current_user} do
 687       note_activity = insert(:note_activity)
 688
 689       conn =
 690         conn
 691         |> with_credentials(current_user.nickname, "test")
 692         |> post("/api/favorites/create/#{note_activity.id}.json")
 693
 694       assert json_response(conn, 200)
 695     end
 696
 697     test "with credentials, invalid param", %{conn: conn, user: current_user} do
 698       conn =
 699         conn
 700         |> with_credentials(current_user.nickname, "test")
 701         |> post("/api/favorites/create/wrong.json")
 702
 703       assert json_response(conn, 400)
 704     end
 705
 706     test "with credentials, invalid activity", %{conn: conn, user: current_user} do
 707       conn =
 708         conn
 709         |> with_credentials(current_user.nickname, "test")
 710         |> post("/api/favorites/create/1.json")
 711
 712       assert json_response(conn, 500)
 713     end
 714   end
 715
 716   describe "POST /api/favorites/destroy/:id" do
 717     setup [:valid_user]
 718
 719     test "without valid credentials", %{conn: conn} do
 720       note_activity = insert(:note_activity)
 721       conn = post(conn, "/api/favorites/destroy/#{note_activity.id}.json")
 722       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 723     end
 724
 725     test "with credentials", %{conn: conn, user: current_user} do
 726       note_activity = insert(:note_activity)
 727       object = Object.get_by_ap_id(note_activity.data["object"]["id"])
 728       ActivityPub.like(current_user, object)
 729
 730       conn =
 731         conn
 732         |> with_credentials(current_user.nickname, "test")
 733         |> post("/api/favorites/destroy/#{note_activity.id}.json")
 734
 735       assert json_response(conn, 200)
 736     end
 737   end
 738
 739   describe "POST /api/statuses/retweet/:id" do
 740     setup [:valid_user]
 741
 742     test "without valid credentials", %{conn: conn} do
 743       note_activity = insert(:note_activity)
 744       conn = post(conn, "/api/statuses/retweet/#{note_activity.id}.json")
 745       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 746     end
 747
 748     test "with credentials", %{conn: conn, user: current_user} do
 749       note_activity = insert(:note_activity)
 750
 751       request_path = "/api/statuses/retweet/#{note_activity.id}.json"
 752
 753       response =
 754         conn
 755         |> with_credentials(current_user.nickname, "test")
 756         |> post(request_path)
 757
 758       activity = Repo.get(Activity, note_activity.id)
 759       activity_user = Repo.get_by(User, ap_id: note_activity.data["actor"])
 760
 761       assert json_response(response, 200) ==
 762                ActivityRepresenter.to_map(activity, %{user: activity_user, for: current_user})
 763     end
 764   end
 765
 766   describe "POST /api/statuses/unretweet/:id" do
 767     setup [:valid_user]
 768
 769     test "without valid credentials", %{conn: conn} do
 770       note_activity = insert(:note_activity)
 771       conn = post(conn, "/api/statuses/unretweet/#{note_activity.id}.json")
 772       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 773     end
 774
 775     test "with credentials", %{conn: conn, user: current_user} do
 776       note_activity = insert(:note_activity)
 777
 778       request_path = "/api/statuses/retweet/#{note_activity.id}.json"
 779
 780       _response =
 781         conn
 782         |> with_credentials(current_user.nickname, "test")
 783         |> post(request_path)
 784
 785       request_path = String.replace(request_path, "retweet", "unretweet")
 786
 787       response =
 788         conn
 789         |> with_credentials(current_user.nickname, "test")
 790         |> post(request_path)
 791
 792       activity = Repo.get(Activity, note_activity.id)
 793       activity_user = Repo.get_by(User, ap_id: note_activity.data["actor"])
 794
 795       assert json_response(response, 200) ==
 796                ActivityRepresenter.to_map(activity, %{user: activity_user, for: current_user})
 797     end
 798   end
 799
 800   describe "POST /api/account/register" do
 801     test "it creates a new user", %{conn: conn} do
 802       data = %{
 803         "nickname" => "lain",
 804         "email" => "lain@wired.jp",
 805         "fullname" => "lain iwakura",
 806         "bio" => "close the world.",
 807         "password" => "bear",
 808         "confirm" => "bear"
 809       }
 810
 811       conn =
 812         conn
 813         |> post("/api/account/register", data)
 814
 815       user = json_response(conn, 200)
 816
 817       fetched_user = Repo.get_by(User, nickname: "lain")
 818       assert user == UserView.render("show.json", %{user: fetched_user})
 819     end
 820
 821     test "it returns errors on a problem", %{conn: conn} do
 822       data = %{
 823         "email" => "lain@wired.jp",
 824         "fullname" => "lain iwakura",
 825         "bio" => "close the world.",
 826         "password" => "bear",
 827         "confirm" => "bear"
 828       }
 829
 830       conn =
 831         conn
 832         |> post("/api/account/register", data)
 833
 834       errors = json_response(conn, 400)
 835
 836       assert is_binary(errors["error"])
 837     end
 838   end
 839
 840   describe "POST /api/account/password_reset, with valid parameters" do
 841     setup %{conn: conn} do
 842       user = insert(:user)
 843       conn = post(conn, "/api/account/password_reset?email=#{user.email}")
 844       %{conn: conn, user: user}
 845     end
 846
 847     test "it returns 204", %{conn: conn} do
 848       assert json_response(conn, :no_content)
 849     end
 850
 851     test "it creates a PasswordResetToken record for user", %{user: user} do
 852       token_record = Repo.get_by(Pleroma.PasswordResetToken, user_id: user.id)
 853       assert token_record
 854     end
 855
 856     test "it sends an email to user", %{user: user} do
 857       token_record = Repo.get_by(Pleroma.PasswordResetToken, user_id: user.id)
 858
 859       Swoosh.TestAssertions.assert_email_sent(
 860         Pleroma.UserEmail.password_reset_email(user, token_record.token)
 861       )
 862     end
 863   end
 864
 865   describe "POST /api/account/password_reset, with invalid parameters" do
 866     setup [:valid_user]
 867
 868     test "it returns 500 when user is not found", %{conn: conn, user: user} do
 869       conn = post(conn, "/api/account/password_reset?email=nonexisting_#{user.email}")
 870       assert json_response(conn, :internal_server_error)
 871     end
 872
 873     test "it returns 500 when user is not local", %{conn: conn, user: user} do
 874       {:ok, user} = Repo.update(Changeset.change(user, local: false))
 875       conn = post(conn, "/api/account/password_reset?email=#{user.email}")
 876       assert json_response(conn, :internal_server_error)
 877     end
 878   end
 879
 880   describe "GET /api/account/confirm_email/:id/:token" do
 881     setup do
 882       user = insert(:user)
 883       info_change = User.Info.confirmation_changeset(user.info, :unconfirmed)
 884
 885       {:ok, user} =
 886         user
 887         |> Changeset.change()
 888         |> Changeset.put_embed(:info, info_change)
 889         |> Repo.update()
 890
 891       assert user.info.confirmation_pending
 892
 893       [user: user]
 894     end
 895
 896     test "it redirects to root url", %{conn: conn, user: user} do
 897       conn = get(conn, "/api/account/confirm_email/#{user.id}/#{user.info.confirmation_token}")
 898
 899       assert 302 == conn.status
 900     end
 901
 902     test "it confirms the user account", %{conn: conn, user: user} do
 903       get(conn, "/api/account/confirm_email/#{user.id}/#{user.info.confirmation_token}")
 904
 905       user = Repo.get(User, user.id)
 906
 907       refute user.info.confirmation_pending
 908       refute user.info.confirmation_token
 909     end
 910
 911     test "it returns 500 if user cannot be found by id", %{conn: conn, user: user} do
 912       conn = get(conn, "/api/account/confirm_email/0/#{user.info.confirmation_token}")
 913
 914       assert 500 == conn.status
 915     end
 916
 917     test "it returns 500 if token is invalid", %{conn: conn, user: user} do
 918       conn = get(conn, "/api/account/confirm_email/#{user.id}/wrong_token")
 919
 920       assert 500 == conn.status
 921     end
 922   end
 923
 924   describe "POST /api/account/resend_confirmation_email" do
 925     setup do
 926       setting = Pleroma.Config.get([:instance, :account_activation_required])
 927
 928       unless setting do
 929         Pleroma.Config.put([:instance, :account_activation_required], true)
 930         on_exit(fn -> Pleroma.Config.put([:instance, :account_activation_required], setting) end)
 931       end
 932
 933       user = insert(:user)
 934       info_change = User.Info.confirmation_changeset(user.info, :unconfirmed)
 935
 936       {:ok, user} =
 937         user
 938         |> Changeset.change()
 939         |> Changeset.put_embed(:info, info_change)
 940         |> Repo.update()
 941
 942       assert user.info.confirmation_pending
 943
 944       [user: user]
 945     end
 946
 947     test "it returns 204 No Content", %{conn: conn, user: user} do
 948       conn
 949       |> assign(:user, user)
 950       |> post("/api/account/resend_confirmation_email?email=#{user.email}")
 951       |> json_response(:no_content)
 952     end
 953
 954     test "it sends confirmation email", %{conn: conn, user: user} do
 955       conn
 956       |> assign(:user, user)
 957       |> post("/api/account/resend_confirmation_email?email=#{user.email}")
 958
 959       Swoosh.TestAssertions.assert_email_sent(Pleroma.UserEmail.account_confirmation_email(user))
 960     end
 961   end
 962
 963   describe "GET /api/externalprofile/show" do
 964     test "it returns the user", %{conn: conn} do
 965       user = insert(:user)
 966       other_user = insert(:user)
 967
 968       conn =
 969         conn
 970         |> assign(:user, user)
 971         |> get("/api/externalprofile/show", %{profileurl: other_user.ap_id})
 972
 973       assert json_response(conn, 200) == UserView.render("show.json", %{user: other_user})
 974     end
 975   end
 976
 977   describe "GET /api/statuses/followers" do
 978     test "it returns a user's followers", %{conn: conn} do
 979       user = insert(:user)
 980       follower_one = insert(:user)
 981       follower_two = insert(:user)
 982       _not_follower = insert(:user)
 983
 984       {:ok, follower_one} = User.follow(follower_one, user)
 985       {:ok, follower_two} = User.follow(follower_two, user)
 986
 987       conn =
 988         conn
 989         |> assign(:user, user)
 990         |> get("/api/statuses/followers")
 991
 992       expected = UserView.render("index.json", %{users: [follower_one, follower_two], for: user})
 993       result = json_response(conn, 200)
 994       assert Enum.sort(expected) == Enum.sort(result)
 995     end
 996
 997     test "it returns a given user's followers with user_id", %{conn: conn} do
 998       user = insert(:user)
 999       follower_one = insert(:user)
1000       follower_two = insert(:user)
1001       not_follower = insert(:user)
1002
1003       {:ok, follower_one} = User.follow(follower_one, user)
1004       {:ok, follower_two} = User.follow(follower_two, user)
1005
1006       conn =
1007         conn
1008         |> assign(:user, not_follower)
1009         |> get("/api/statuses/followers", %{"user_id" => user.id})
1010
1011       assert MapSet.equal?(
1012                MapSet.new(json_response(conn, 200)),
1013                MapSet.new(
1014                  UserView.render("index.json", %{
1015                    users: [follower_one, follower_two],
1016                    for: not_follower
1017                  })
1018                )
1019              )
1020     end
1021
1022     test "it returns empty for a hidden network", %{conn: conn} do
1023       user = insert(:user, %{info: %{hide_network: true}})
1024       follower_one = insert(:user)
1025       follower_two = insert(:user)
1026       not_follower = insert(:user)
1027
1028       {:ok, _follower_one} = User.follow(follower_one, user)
1029       {:ok, _follower_two} = User.follow(follower_two, user)
1030
1031       response =
1032         conn
1033         |> assign(:user, not_follower)
1034         |> get("/api/statuses/followers", %{"user_id" => user.id})
1035         |> json_response(200)
1036
1037       assert [] == response
1038     end
1039
1040     test "it returns the followers for a hidden network if requested by the user themselves", %{
1041       conn: conn
1042     } do
1043       user = insert(:user, %{info: %{hide_network: true}})
1044       follower_one = insert(:user)
1045       follower_two = insert(:user)
1046       _not_follower = insert(:user)
1047
1048       {:ok, _follower_one} = User.follow(follower_one, user)
1049       {:ok, _follower_two} = User.follow(follower_two, user)
1050
1051       conn =
1052         conn
1053         |> assign(:user, user)
1054         |> get("/api/statuses/followers", %{"user_id" => user.id})
1055
1056       refute [] == json_response(conn, 200)
1057     end
1058   end
1059
1060   describe "GET /api/statuses/friends" do
1061     test "it returns the logged in user's friends", %{conn: conn} do
1062       user = insert(:user)
1063       followed_one = insert(:user)
1064       followed_two = insert(:user)
1065       _not_followed = insert(:user)
1066
1067       {:ok, user} = User.follow(user, followed_one)
1068       {:ok, user} = User.follow(user, followed_two)
1069
1070       conn =
1071         conn
1072         |> assign(:user, user)
1073         |> get("/api/statuses/friends")
1074
1075       expected = UserView.render("index.json", %{users: [followed_one, followed_two], for: user})
1076       result = json_response(conn, 200)
1077       assert Enum.sort(expected) == Enum.sort(result)
1078     end
1079
1080     test "it returns a given user's friends with user_id", %{conn: conn} do
1081       user = insert(:user)
1082       followed_one = insert(:user)
1083       followed_two = insert(:user)
1084       _not_followed = insert(:user)
1085
1086       {:ok, user} = User.follow(user, followed_one)
1087       {:ok, user} = User.follow(user, followed_two)
1088
1089       conn =
1090         conn
1091         |> assign(:user, user)
1092         |> get("/api/statuses/friends", %{"user_id" => user.id})
1093
1094       assert MapSet.equal?(
1095                MapSet.new(json_response(conn, 200)),
1096                MapSet.new(
1097                  UserView.render("index.json", %{users: [followed_one, followed_two], for: user})
1098                )
1099              )
1100     end
1101
1102     test "it returns empty for a hidden network", %{conn: conn} do
1103       user = insert(:user, %{info: %{hide_network: true}})
1104       followed_one = insert(:user)
1105       followed_two = insert(:user)
1106       not_followed = insert(:user)
1107
1108       {:ok, user} = User.follow(user, followed_one)
1109       {:ok, user} = User.follow(user, followed_two)
1110
1111       conn =
1112         conn
1113         |> assign(:user, not_followed)
1114         |> get("/api/statuses/friends", %{"user_id" => user.id})
1115
1116       assert [] == json_response(conn, 200)
1117     end
1118
1119     test "it returns friends for a hidden network if the user themselves request it", %{
1120       conn: conn
1121     } do
1122       user = insert(:user, %{info: %{hide_network: true}})
1123       followed_one = insert(:user)
1124       followed_two = insert(:user)
1125       _not_followed = insert(:user)
1126
1127       {:ok, _user} = User.follow(user, followed_one)
1128       {:ok, _user} = User.follow(user, followed_two)
1129
1130       response =
1131         conn
1132         |> assign(:user, user)
1133         |> get("/api/statuses/friends", %{"user_id" => user.id})
1134         |> json_response(200)
1135
1136       refute [] == response
1137     end
1138
1139     test "it returns a given user's friends with screen_name", %{conn: conn} do
1140       user = insert(:user)
1141       followed_one = insert(:user)
1142       followed_two = insert(:user)
1143       _not_followed = insert(:user)
1144
1145       {:ok, user} = User.follow(user, followed_one)
1146       {:ok, user} = User.follow(user, followed_two)
1147
1148       conn =
1149         conn
1150         |> assign(:user, user)
1151         |> get("/api/statuses/friends", %{"screen_name" => user.nickname})
1152
1153       assert MapSet.equal?(
1154                MapSet.new(json_response(conn, 200)),
1155                MapSet.new(
1156                  UserView.render("index.json", %{users: [followed_one, followed_two], for: user})
1157                )
1158              )
1159     end
1160   end
1161
1162   describe "GET /friends/ids" do
1163     test "it returns a user's friends", %{conn: conn} do
1164       user = insert(:user)
1165       followed_one = insert(:user)
1166       followed_two = insert(:user)
1167       _not_followed = insert(:user)
1168
1169       {:ok, user} = User.follow(user, followed_one)
1170       {:ok, user} = User.follow(user, followed_two)
1171
1172       conn =
1173         conn
1174         |> assign(:user, user)
1175         |> get("/api/friends/ids")
1176
1177       expected = [followed_one.id, followed_two.id]
1178
1179       assert MapSet.equal?(
1180                MapSet.new(Poison.decode!(json_response(conn, 200))),
1181                MapSet.new(expected)
1182              )
1183     end
1184   end
1185
1186   describe "POST /api/account/update_profile.json" do
1187     test "it updates a user's profile", %{conn: conn} do
1188       user = insert(:user)
1189       user2 = insert(:user)
1190
1191       conn =
1192         conn
1193         |> assign(:user, user)
1194         |> post("/api/account/update_profile.json", %{
1195           "name" => "new name",
1196           "description" => "hi @#{user2.nickname}"
1197         })
1198
1199       user = Repo.get!(User, user.id)
1200       assert user.name == "new name"
1201
1202       assert user.bio ==
1203                "hi <span><a data-user='#{user2.id}' class='mention' href='#{user2.ap_id}'>@<span>#{
1204                  user2.nickname
1205                }</span></a></span>"
1206
1207       assert json_response(conn, 200) == UserView.render("user.json", %{user: user, for: user})
1208     end
1209
1210     test "it sets and un-sets hide_network", %{conn: conn} do
1211       user = insert(:user)
1212
1213       conn
1214       |> assign(:user, user)
1215       |> post("/api/account/update_profile.json", %{
1216         "hide_network" => "true"
1217       })
1218
1219       user = Repo.get!(User, user.id)
1220       assert user.info.hide_network == true
1221
1222       conn =
1223         conn
1224         |> assign(:user, user)
1225         |> post("/api/account/update_profile.json", %{
1226           "hide_network" => "false"
1227         })
1228
1229       user = Repo.get!(User, user.id)
1230       assert user.info.hide_network == false
1231       assert json_response(conn, 200) == UserView.render("user.json", %{user: user, for: user})
1232     end
1233
1234     test "it locks an account", %{conn: conn} do
1235       user = insert(:user)
1236
1237       conn =
1238         conn
1239         |> assign(:user, user)
1240         |> post("/api/account/update_profile.json", %{
1241           "locked" => "true"
1242         })
1243
1244       user = Repo.get!(User, user.id)
1245       assert user.info.locked == true
1246
1247       assert json_response(conn, 200) == UserView.render("user.json", %{user: user, for: user})
1248     end
1249
1250     test "it unlocks an account", %{conn: conn} do
1251       user = insert(:user)
1252
1253       conn =
1254         conn
1255         |> assign(:user, user)
1256         |> post("/api/account/update_profile.json", %{
1257           "locked" => "false"
1258         })
1259
1260       user = Repo.get!(User, user.id)
1261       assert user.info.locked == false
1262
1263       assert json_response(conn, 200) == UserView.render("user.json", %{user: user, for: user})
1264     end
1265   end
1266
1267   defp valid_user(_context) do
1268     user = insert(:user)
1269     [user: user]
1270   end
1271
1272   defp with_credentials(conn, username, password) do
1273     header_content = "Basic " <> Base.encode64("#{username}:#{password}")
1274     put_req_header(conn, "authorization", header_content)
1275   end
1276
1277   describe "GET /api/search.json" do
1278     test "it returns search results", %{conn: conn} do
1279       user = insert(:user)
1280       user_two = insert(:user, %{nickname: "shp@shitposter.club"})
1281
1282       {:ok, activity} = CommonAPI.post(user, %{"status" => "This is about 2hu"})
1283       {:ok, _} = CommonAPI.post(user_two, %{"status" => "This isn't"})
1284
1285       conn =
1286         conn
1287         |> get("/api/search.json", %{"q" => "2hu", "page" => "1", "rpp" => "1"})
1288
1289       assert [status] = json_response(conn, 200)
1290       assert status["id"] == activity.id
1291     end
1292   end
1293
1294   describe "GET /api/statusnet/tags/timeline/:tag.json" do
1295     test "it returns the tags timeline", %{conn: conn} do
1296       user = insert(:user)
1297       user_two = insert(:user, %{nickname: "shp@shitposter.club"})
1298
1299       {:ok, activity} = CommonAPI.post(user, %{"status" => "This is about #2hu"})
1300       {:ok, _} = CommonAPI.post(user_two, %{"status" => "This isn't"})
1301
1302       conn =
1303         conn
1304         |> get("/api/statusnet/tags/timeline/2hu.json")
1305
1306       assert [status] = json_response(conn, 200)
1307       assert status["id"] == activity.id
1308     end
1309   end
1310
1311   test "Convert newlines to <br> in bio", %{conn: conn} do
1312     user = insert(:user)
1313
1314     _conn =
1315       conn
1316       |> assign(:user, user)
1317       |> post("/api/account/update_profile.json", %{
1318         "description" => "Hello,\r\nWorld! I\n am a test."
1319       })
1320
1321     user = Repo.get!(User, user.id)
1322     assert user.bio == "Hello,<br>World! I<br> am a test."
1323   end
1324
1325   describe "POST /api/pleroma/change_password" do
1326     setup [:valid_user]
1327
1328     test "without credentials", %{conn: conn} do
1329       conn = post(conn, "/api/pleroma/change_password")
1330       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
1331     end
1332
1333     test "with credentials and invalid password", %{conn: conn, user: current_user} do
1334       conn =
1335         conn
1336         |> with_credentials(current_user.nickname, "test")
1337         |> post("/api/pleroma/change_password", %{
1338           "password" => "hi",
1339           "new_password" => "newpass",
1340           "new_password_confirmation" => "newpass"
1341         })
1342
1343       assert json_response(conn, 200) == %{"error" => "Invalid password."}
1344     end
1345
1346     test "with credentials, valid password and new password and confirmation not matching", %{
1347       conn: conn,
1348       user: current_user
1349     } do
1350       conn =
1351         conn
1352         |> with_credentials(current_user.nickname, "test")
1353         |> post("/api/pleroma/change_password", %{
1354           "password" => "test",
1355           "new_password" => "newpass",
1356           "new_password_confirmation" => "notnewpass"
1357         })
1358
1359       assert json_response(conn, 200) == %{
1360                "error" => "New password does not match confirmation."
1361              }
1362     end
1363
1364     test "with credentials, valid password and invalid new password", %{
1365       conn: conn,
1366       user: current_user
1367     } do
1368       conn =
1369         conn
1370         |> with_credentials(current_user.nickname, "test")
1371         |> post("/api/pleroma/change_password", %{
1372           "password" => "test",
1373           "new_password" => "",
1374           "new_password_confirmation" => ""
1375         })
1376
1377       assert json_response(conn, 200) == %{
1378                "error" => "New password can't be blank."
1379              }
1380     end
1381
1382     test "with credentials, valid password and matching new password and confirmation", %{
1383       conn: conn,
1384       user: current_user
1385     } do
1386       conn =
1387         conn
1388         |> with_credentials(current_user.nickname, "test")
1389         |> post("/api/pleroma/change_password", %{
1390           "password" => "test",
1391           "new_password" => "newpass",
1392           "new_password_confirmation" => "newpass"
1393         })
1394
1395       assert json_response(conn, 200) == %{"status" => "success"}
1396       fetched_user = Repo.get(User, current_user.id)
1397       assert Pbkdf2.checkpw("newpass", fetched_user.password_hash) == true
1398     end
1399   end
1400
1401   describe "POST /api/pleroma/delete_account" do
1402     setup [:valid_user]
1403
1404     test "without credentials", %{conn: conn} do
1405       conn = post(conn, "/api/pleroma/delete_account")
1406       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
1407     end
1408
1409     test "with credentials and invalid password", %{conn: conn, user: current_user} do
1410       conn =
1411         conn
1412         |> with_credentials(current_user.nickname, "test")
1413         |> post("/api/pleroma/delete_account", %{"password" => "hi"})
1414
1415       assert json_response(conn, 200) == %{"error" => "Invalid password."}
1416     end
1417
1418     test "with credentials and valid password", %{conn: conn, user: current_user} do
1419       conn =
1420         conn
1421         |> with_credentials(current_user.nickname, "test")
1422         |> post("/api/pleroma/delete_account", %{"password" => "test"})
1423
1424       assert json_response(conn, 200) == %{"status" => "success"}
1425       # Wait a second for the started task to end
1426       :timer.sleep(1000)
1427     end
1428   end
1429
1430   describe "GET /api/pleroma/friend_requests" do
1431     test "it lists friend requests" do
1432       user = insert(:user)
1433       other_user = insert(:user)
1434
1435       {:ok, _activity} = ActivityPub.follow(other_user, user)
1436
1437       user = Repo.get(User, user.id)
1438       other_user = Repo.get(User, other_user.id)
1439
1440       assert User.following?(other_user, user) == false
1441
1442       conn =
1443         build_conn()
1444         |> assign(:user, user)
1445         |> get("/api/pleroma/friend_requests")
1446
1447       assert [relationship] = json_response(conn, 200)
1448       assert other_user.id == relationship["id"]
1449     end
1450   end
1451
1452   describe "POST /api/pleroma/friendships/approve" do
1453     test "it approves a friend request" do
1454       user = insert(:user)
1455       other_user = insert(:user)
1456
1457       {:ok, _activity} = ActivityPub.follow(other_user, user)
1458
1459       user = Repo.get(User, user.id)
1460       other_user = Repo.get(User, other_user.id)
1461
1462       assert User.following?(other_user, user) == false
1463
1464       conn =
1465         build_conn()
1466         |> assign(:user, user)
1467         |> post("/api/pleroma/friendships/approve", %{"user_id" => to_string(other_user.id)})
1468
1469       assert relationship = json_response(conn, 200)
1470       assert other_user.id == relationship["id"]
1471       assert relationship["follows_you"] == true
1472     end
1473   end
1474
1475   describe "POST /api/pleroma/friendships/deny" do
1476     test "it denies a friend request" do
1477       user = insert(:user)
1478       other_user = insert(:user)
1479
1480       {:ok, _activity} = ActivityPub.follow(other_user, user)
1481
1482       user = Repo.get(User, user.id)
1483       other_user = Repo.get(User, other_user.id)
1484
1485       assert User.following?(other_user, user) == false
1486
1487       conn =
1488         build_conn()
1489         |> assign(:user, user)
1490         |> post("/api/pleroma/friendships/deny", %{"user_id" => to_string(other_user.id)})
1491
1492       assert relationship = json_response(conn, 200)
1493       assert other_user.id == relationship["id"]
1494       assert relationship["follows_you"] == false
1495     end
1496   end
1497
1498   describe "GET /api/pleroma/search_user" do
1499     test "it returns users, ordered by similarity", %{conn: conn} do
1500       user = insert(:user, %{name: "eal"})
1501       user_two = insert(:user, %{name: "ean"})
1502       user_three = insert(:user, %{name: "ebn"})
1503
1504       resp =
1505         conn
1506         |> get(twitter_api_search__path(conn, :search_user), query: "eal")
1507         |> json_response(200)
1508
1509       assert length(resp) == 3
1510       assert [user.id, user_two.id, user_three.id] == Enum.map(resp, fn %{"id" => id} -> id end)
1511     end
1512   end
1513
1514   describe "POST /api/media/upload" do
1515     setup context do
1516       Pleroma.DataCase.ensure_local_uploader(context)
1517     end
1518
1519     test "it performs the upload and sets `data[actor]` with AP id of uploader user", %{
1520       conn: conn
1521     } do
1522       user = insert(:user)
1523
1524       upload_filename = "test/fixtures/image_tmp.jpg"
1525       File.cp!("test/fixtures/image.jpg", upload_filename)
1526
1527       file = %Plug.Upload{
1528         content_type: "image/jpg",
1529         path: Path.absname(upload_filename),
1530         filename: "image.jpg"
1531       }
1532
1533       response =
1534         conn
1535         |> assign(:user, user)
1536         |> put_req_header("content-type", "application/octet-stream")
1537         |> post("/api/media/upload", %{
1538           "media" => file
1539         })
1540         |> json_response(:ok)
1541
1542       assert response["media_id"]
1543       object = Repo.get(Object, response["media_id"])
1544       assert object
1545       assert object.data["actor"] == User.ap_id(user)
1546     end
1547   end
1548
1549   describe "POST /api/media/metadata/create" do
1550     setup do
1551       object = insert(:note)
1552       user = User.get_by_ap_id(object.data["actor"])
1553       %{object: object, user: user}
1554     end
1555
1556     test "it returns :forbidden status on attempt to modify someone else's upload", %{
1557       conn: conn,
1558       object: object
1559     } do
1560       initial_description = object.data["name"]
1561       another_user = insert(:user)
1562
1563       conn
1564       |> assign(:user, another_user)
1565       |> post("/api/media/metadata/create", %{"media_id" => object.id})
1566       |> json_response(:forbidden)
1567
1568       object = Repo.get(Object, object.id)
1569       assert object.data["name"] == initial_description
1570     end
1571
1572     test "it updates `data[name]` of referenced Object with provided value", %{
1573       conn: conn,
1574       object: object,
1575       user: user
1576     } do
1577       description = "Informative description of the image. Initial value: #{object.data["name"]}}"
1578
1579       conn
1580       |> assign(:user, user)
1581       |> post("/api/media/metadata/create", %{
1582         "media_id" => object.id,
1583         "alt_text" => %{"text" => description}
1584       })
1585       |> json_response(:no_content)
1586
1587       object = Repo.get(Object, object.id)
1588       assert object.data["name"] == description
1589     end
1590   end
1591 end