git.squeep.com Git - akkoma/blob - test/web/twitter_api/twitter_api_controller_test.exs

   1 defmodule Pleroma.Web.TwitterAPI.ControllerTest do
   2   use Pleroma.Web.ConnCase
   3   alias Pleroma.Web.TwitterAPI.Representers.ActivityRepresenter
   4   alias Pleroma.Builders.{ActivityBuilder, UserBuilder}
   5   alias Pleroma.{Repo, Activity, User, Object, Notification}
   6   alias Pleroma.Web.ActivityPub.ActivityPub
   7   alias Pleroma.Web.TwitterAPI.UserView
   8   alias Pleroma.Web.TwitterAPI.NotificationView
   9   alias Pleroma.Web.CommonAPI
  10   alias Pleroma.Web.TwitterAPI.TwitterAPI
  11   alias Comeonin.Pbkdf2
  12
  13   import Pleroma.Factory
  14
  15   describe "POST /api/account/update_profile_banner" do
  16     test "it updates the banner", %{conn: conn} do
  17       user = insert(:user)
  18
  19       new_banner =
  20         "data:image/gif;base64,R0lGODlhEAAQAMQAAORHHOVSKudfOulrSOp3WOyDZu6QdvCchPGolfO0o/XBs/fNwfjZ0frl3/zy7////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAkAABAALAAAAAAQABAAAAVVICSOZGlCQAosJ6mu7fiyZeKqNKToQGDsM8hBADgUXoGAiqhSvp5QAnQKGIgUhwFUYLCVDFCrKUE1lBavAViFIDlTImbKC5Gm2hB0SlBCBMQiB0UjIQA7"
  21
  22       response =
  23         conn
  24         |> assign(:user, user)
  25         |> post(authenticated_twitter_api__path(conn, :update_banner), %{"banner" => new_banner})
  26         |> json_response(200)
  27     end
  28   end
  29
  30   describe "POST /api/qvitter/update_background_image" do
  31     test "it updates the background", %{conn: conn} do
  32       user = insert(:user)
  33
  34       new_bg =
  35         "data:image/gif;base64,R0lGODlhEAAQAMQAAORHHOVSKudfOulrSOp3WOyDZu6QdvCchPGolfO0o/XBs/fNwfjZ0frl3/zy7////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAkAABAALAAAAAAQABAAAAVVICSOZGlCQAosJ6mu7fiyZeKqNKToQGDsM8hBADgUXoGAiqhSvp5QAnQKGIgUhwFUYLCVDFCrKUE1lBavAViFIDlTImbKC5Gm2hB0SlBCBMQiB0UjIQA7"
  36
  37       response =
  38         conn
  39         |> assign(:user, user)
  40         |> post(authenticated_twitter_api__path(conn, :update_background), %{"img" => new_bg})
  41         |> json_response(200)
  42     end
  43   end
  44
  45   describe "POST /api/account/verify_credentials" do
  46     setup [:valid_user]
  47
  48     test "without valid credentials", %{conn: conn} do
  49       conn = post(conn, "/api/account/verify_credentials.json")
  50       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
  51     end
  52
  53     test "with credentials", %{conn: conn, user: user} do
  54       conn =
  55         conn
  56         |> with_credentials(user.nickname, "test")
  57         |> post("/api/account/verify_credentials.json")
  58
  59       assert response = json_response(conn, 200)
  60       assert response == UserView.render("show.json", %{user: user, token: response["token"]})
  61     end
  62   end
  63
  64   describe "POST /statuses/update.json" do
  65     setup [:valid_user]
  66
  67     test "without valid credentials", %{conn: conn} do
  68       conn = post(conn, "/api/statuses/update.json")
  69       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
  70     end
  71
  72     test "with credentials", %{conn: conn, user: user} do
  73       conn_with_creds = conn |> with_credentials(user.nickname, "test")
  74       request_path = "/api/statuses/update.json"
  75
  76       error_response = %{
  77         "request" => request_path,
  78         "error" => "Client must provide a 'status' parameter with a value."
  79       }
  80
  81       conn = conn_with_creds |> post(request_path)
  82       assert json_response(conn, 400) == error_response
  83
  84       conn = conn_with_creds |> post(request_path, %{status: ""})
  85       assert json_response(conn, 400) == error_response
  86
  87       conn = conn_with_creds |> post(request_path, %{status: " "})
  88       assert json_response(conn, 400) == error_response
  89
  90       # we post with visibility private in order to avoid triggering relay
  91       conn = conn_with_creds |> post(request_path, %{status: "Nice meme.", visibility: "private"})
  92
  93       assert json_response(conn, 200) ==
  94                ActivityRepresenter.to_map(Repo.one(Activity), %{user: user})
  95     end
  96   end
  97
  98   describe "GET /statuses/public_timeline.json" do
  99     test "returns statuses", %{conn: conn} do
 100       user = insert(:user)
 101       activities = ActivityBuilder.insert_list(30, %{}, %{user: user})
 102       ActivityBuilder.insert_list(10, %{}, %{user: user})
 103       since_id = List.last(activities).id
 104
 105       conn =
 106         conn
 107         |> get("/api/statuses/public_timeline.json", %{since_id: since_id})
 108
 109       response = json_response(conn, 200)
 110
 111       assert length(response) == 10
 112     end
 113
 114     test "returns 403 to unauthenticated request when the instance is not public" do
 115       instance =
 116         Application.get_env(:pleroma, :instance)
 117         |> Keyword.put(:public, false)
 118
 119       Application.put_env(:pleroma, :instance, instance)
 120
 121       conn
 122       |> get("/api/statuses/public_timeline.json")
 123       |> json_response(403)
 124
 125       instance =
 126         Application.get_env(:pleroma, :instance)
 127         |> Keyword.put(:public, true)
 128
 129       Application.put_env(:pleroma, :instance, instance)
 130     end
 131
 132     test "returns 200 to unauthenticated request when the instance is public" do
 133       conn
 134       |> get("/api/statuses/public_timeline.json")
 135       |> json_response(200)
 136     end
 137   end
 138
 139   describe "GET /statuses/public_and_external_timeline.json" do
 140     test "returns 403 to unauthenticated request when the instance is not public" do
 141       instance =
 142         Application.get_env(:pleroma, :instance)
 143         |> Keyword.put(:public, false)
 144
 145       Application.put_env(:pleroma, :instance, instance)
 146
 147       conn
 148       |> get("/api/statuses/public_and_external_timeline.json")
 149       |> json_response(403)
 150
 151       instance =
 152         Application.get_env(:pleroma, :instance)
 153         |> Keyword.put(:public, true)
 154
 155       Application.put_env(:pleroma, :instance, instance)
 156     end
 157
 158     test "returns 200 to unauthenticated request when the instance is public" do
 159       conn
 160       |> get("/api/statuses/public_and_external_timeline.json")
 161       |> json_response(200)
 162     end
 163   end
 164
 165   describe "GET /statuses/show/:id.json" do
 166     test "returns one status", %{conn: conn} do
 167       user = insert(:user)
 168       {:ok, activity} = CommonAPI.post(user, %{"status" => "Hey!"})
 169       actor = Repo.get_by!(User, ap_id: activity.data["actor"])
 170
 171       conn =
 172         conn
 173         |> get("/api/statuses/show/#{activity.id}.json")
 174
 175       response = json_response(conn, 200)
 176
 177       assert response == ActivityRepresenter.to_map(activity, %{user: actor})
 178     end
 179   end
 180
 181   describe "GET /users/show.json" do
 182     test "gets user with screen_name", %{conn: conn} do
 183       user = insert(:user)
 184
 185       conn =
 186         conn
 187         |> get("/api/users/show.json", %{"screen_name" => user.nickname})
 188
 189       response = json_response(conn, 200)
 190
 191       assert response["id"] == user.id
 192     end
 193
 194     test "gets user with user_id", %{conn: conn} do
 195       user = insert(:user)
 196
 197       conn =
 198         conn
 199         |> get("/api/users/show.json", %{"user_id" => user.id})
 200
 201       response = json_response(conn, 200)
 202
 203       assert response["id"] == user.id
 204     end
 205
 206     test "gets a user for a logged in user", %{conn: conn} do
 207       user = insert(:user)
 208       logged_in = insert(:user)
 209
 210       {:ok, logged_in, user, _activity} = TwitterAPI.follow(logged_in, %{"user_id" => user.id})
 211
 212       conn =
 213         conn
 214         |> with_credentials(logged_in.nickname, "test")
 215         |> get("/api/users/show.json", %{"user_id" => user.id})
 216
 217       response = json_response(conn, 200)
 218
 219       assert response["following"] == true
 220     end
 221   end
 222
 223   describe "GET /statusnet/conversation/:id.json" do
 224     test "returns the statuses in the conversation", %{conn: conn} do
 225       {:ok, _user} = UserBuilder.insert()
 226       {:ok, activity} = ActivityBuilder.insert(%{"type" => "Create", "context" => "2hu"})
 227       {:ok, _activity_two} = ActivityBuilder.insert(%{"type" => "Create", "context" => "2hu"})
 228       {:ok, _activity_three} = ActivityBuilder.insert(%{"type" => "Create", "context" => "3hu"})
 229
 230       conn =
 231         conn
 232         |> get("/api/statusnet/conversation/#{activity.data["context_id"]}.json")
 233
 234       response = json_response(conn, 200)
 235
 236       assert length(response) == 2
 237     end
 238   end
 239
 240   describe "GET /statuses/friends_timeline.json" do
 241     setup [:valid_user]
 242
 243     test "without valid credentials", %{conn: conn} do
 244       conn = get(conn, "/api/statuses/friends_timeline.json")
 245       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 246     end
 247
 248     test "with credentials", %{conn: conn, user: current_user} do
 249       user = insert(:user)
 250
 251       activities =
 252         ActivityBuilder.insert_list(30, %{"to" => [User.ap_followers(user)]}, %{user: user})
 253
 254       returned_activities =
 255         ActivityBuilder.insert_list(10, %{"to" => [User.ap_followers(user)]}, %{user: user})
 256
 257       other_user = insert(:user)
 258       ActivityBuilder.insert_list(10, %{}, %{user: other_user})
 259       since_id = List.last(activities).id
 260
 261       current_user =
 262         Ecto.Changeset.change(current_user, following: [User.ap_followers(user)])
 263         |> Repo.update!()
 264
 265       conn =
 266         conn
 267         |> with_credentials(current_user.nickname, "test")
 268         |> get("/api/statuses/friends_timeline.json", %{since_id: since_id})
 269
 270       response = json_response(conn, 200)
 271
 272       assert length(response) == 10
 273
 274       assert response ==
 275                Enum.map(returned_activities, fn activity ->
 276                  ActivityRepresenter.to_map(activity, %{
 277                    user: User.get_cached_by_ap_id(activity.data["actor"]),
 278                    for: current_user
 279                  })
 280                end)
 281     end
 282   end
 283
 284   describe "GET /statuses/dm_timeline.json" do
 285     test "it show direct messages", %{conn: conn} do
 286       user_one = insert(:user)
 287       user_two = insert(:user)
 288
 289       {:ok, user_two} = User.follow(user_two, user_one)
 290
 291       {:ok, direct} =
 292         CommonAPI.post(user_one, %{
 293           "status" => "Hi @#{user_two.nickname}!",
 294           "visibility" => "direct"
 295         })
 296
 297       {:ok, direct_two} =
 298         CommonAPI.post(user_two, %{
 299           "status" => "Hi @#{user_one.nickname}!",
 300           "visibility" => "direct"
 301         })
 302
 303       {:ok, _follower_only} =
 304         CommonAPI.post(user_one, %{
 305           "status" => "Hi @#{user_two.nickname}!",
 306           "visibility" => "private"
 307         })
 308
 309       # Only direct should be visible here
 310       res_conn =
 311         conn
 312         |> assign(:user, user_two)
 313         |> get("/api/statuses/dm_timeline.json")
 314
 315       [status, status_two] = json_response(res_conn, 200)
 316       assert status["id"] == direct_two.id
 317       assert status_two["id"] == direct.id
 318     end
 319   end
 320
 321   describe "GET /statuses/mentions.json" do
 322     setup [:valid_user]
 323
 324     test "without valid credentials", %{conn: conn} do
 325       conn = get(conn, "/api/statuses/mentions.json")
 326       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 327     end
 328
 329     test "with credentials", %{conn: conn, user: current_user} do
 330       {:ok, activity} =
 331         ActivityBuilder.insert(%{"to" => [current_user.ap_id]}, %{user: current_user})
 332
 333       conn =
 334         conn
 335         |> with_credentials(current_user.nickname, "test")
 336         |> get("/api/statuses/mentions.json")
 337
 338       response = json_response(conn, 200)
 339
 340       assert length(response) == 1
 341
 342       assert Enum.at(response, 0) ==
 343                ActivityRepresenter.to_map(activity, %{
 344                  user: current_user,
 345                  mentioned: [current_user]
 346                })
 347     end
 348   end
 349
 350   describe "GET /api/qvitter/statuses/notifications.json" do
 351     setup [:valid_user]
 352
 353     test "without valid credentials", %{conn: conn} do
 354       conn = get(conn, "/api/qvitter/statuses/notifications.json")
 355       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 356     end
 357
 358     test "with credentials", %{conn: conn, user: current_user} do
 359       other_user = insert(:user)
 360
 361       {:ok, _activity} =
 362         ActivityBuilder.insert(%{"to" => [current_user.ap_id]}, %{user: other_user})
 363
 364       conn =
 365         conn
 366         |> with_credentials(current_user.nickname, "test")
 367         |> get("/api/qvitter/statuses/notifications.json")
 368
 369       response = json_response(conn, 200)
 370
 371       assert length(response) == 1
 372
 373       assert response ==
 374                NotificationView.render("notification.json", %{
 375                  notifications: Notification.for_user(current_user),
 376                  for: current_user
 377                })
 378     end
 379   end
 380
 381   describe "POST /api/qvitter/statuses/notifications/read" do
 382     setup [:valid_user]
 383
 384     test "without valid credentials", %{conn: conn} do
 385       conn = post(conn, "/api/qvitter/statuses/notifications/read", %{"latest_id" => 1_234_567})
 386       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 387     end
 388
 389     test "with credentials, without any params", %{conn: conn, user: current_user} do
 390       conn =
 391         conn
 392         |> with_credentials(current_user.nickname, "test")
 393         |> post("/api/qvitter/statuses/notifications/read")
 394
 395       assert json_response(conn, 400) == %{
 396                "error" => "You need to specify latest_id",
 397                "request" => "/api/qvitter/statuses/notifications/read"
 398              }
 399     end
 400
 401     test "with credentials, with params", %{conn: conn, user: current_user} do
 402       other_user = insert(:user)
 403
 404       {:ok, _activity} =
 405         ActivityBuilder.insert(%{"to" => [current_user.ap_id]}, %{user: other_user})
 406
 407       response_conn =
 408         conn
 409         |> with_credentials(current_user.nickname, "test")
 410         |> get("/api/qvitter/statuses/notifications.json")
 411
 412       [notification] = response = json_response(response_conn, 200)
 413
 414       assert length(response) == 1
 415
 416       assert notification["is_seen"] == 0
 417
 418       response_conn =
 419         conn
 420         |> with_credentials(current_user.nickname, "test")
 421         |> post("/api/qvitter/statuses/notifications/read", %{"latest_id" => notification["id"]})
 422
 423       [notification] = response = json_response(response_conn, 200)
 424
 425       assert length(response) == 1
 426
 427       assert notification["is_seen"] == 1
 428     end
 429   end
 430
 431   describe "GET /statuses/user_timeline.json" do
 432     setup [:valid_user]
 433
 434     test "without any params", %{conn: conn} do
 435       conn = get(conn, "/api/statuses/user_timeline.json")
 436
 437       assert json_response(conn, 400) == %{
 438                "error" => "You need to specify screen_name or user_id",
 439                "request" => "/api/statuses/user_timeline.json"
 440              }
 441     end
 442
 443     test "with user_id", %{conn: conn} do
 444       user = insert(:user)
 445       {:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: user})
 446
 447       conn = get(conn, "/api/statuses/user_timeline.json", %{"user_id" => user.id})
 448       response = json_response(conn, 200)
 449       assert length(response) == 1
 450       assert Enum.at(response, 0) == ActivityRepresenter.to_map(activity, %{user: user})
 451     end
 452
 453     test "with screen_name", %{conn: conn} do
 454       user = insert(:user)
 455       {:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: user})
 456
 457       conn = get(conn, "/api/statuses/user_timeline.json", %{"screen_name" => user.nickname})
 458       response = json_response(conn, 200)
 459       assert length(response) == 1
 460       assert Enum.at(response, 0) == ActivityRepresenter.to_map(activity, %{user: user})
 461     end
 462
 463     test "with credentials", %{conn: conn, user: current_user} do
 464       {:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: current_user})
 465
 466       conn =
 467         conn
 468         |> with_credentials(current_user.nickname, "test")
 469         |> get("/api/statuses/user_timeline.json")
 470
 471       response = json_response(conn, 200)
 472
 473       assert length(response) == 1
 474       assert Enum.at(response, 0) == ActivityRepresenter.to_map(activity, %{user: current_user})
 475     end
 476
 477     test "with credentials with user_id", %{conn: conn, user: current_user} do
 478       user = insert(:user)
 479       {:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: user})
 480
 481       conn =
 482         conn
 483         |> with_credentials(current_user.nickname, "test")
 484         |> get("/api/statuses/user_timeline.json", %{"user_id" => user.id})
 485
 486       response = json_response(conn, 200)
 487
 488       assert length(response) == 1
 489       assert Enum.at(response, 0) == ActivityRepresenter.to_map(activity, %{user: user})
 490     end
 491
 492     test "with credentials screen_name", %{conn: conn, user: current_user} do
 493       user = insert(:user)
 494       {:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: user})
 495
 496       conn =
 497         conn
 498         |> with_credentials(current_user.nickname, "test")
 499         |> get("/api/statuses/user_timeline.json", %{"screen_name" => user.nickname})
 500
 501       response = json_response(conn, 200)
 502
 503       assert length(response) == 1
 504       assert Enum.at(response, 0) == ActivityRepresenter.to_map(activity, %{user: user})
 505     end
 506   end
 507
 508   describe "POST /friendships/create.json" do
 509     setup [:valid_user]
 510
 511     test "without valid credentials", %{conn: conn} do
 512       conn = post(conn, "/api/friendships/create.json")
 513       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 514     end
 515
 516     test "with credentials", %{conn: conn, user: current_user} do
 517       followed = insert(:user)
 518
 519       conn =
 520         conn
 521         |> with_credentials(current_user.nickname, "test")
 522         |> post("/api/friendships/create.json", %{user_id: followed.id})
 523
 524       current_user = Repo.get(User, current_user.id)
 525       assert User.ap_followers(followed) in current_user.following
 526
 527       assert json_response(conn, 200) ==
 528                UserView.render("show.json", %{user: followed, for: current_user})
 529     end
 530   end
 531
 532   describe "POST /friendships/destroy.json" do
 533     setup [:valid_user]
 534
 535     test "without valid credentials", %{conn: conn} do
 536       conn = post(conn, "/api/friendships/destroy.json")
 537       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 538     end
 539
 540     test "with credentials", %{conn: conn, user: current_user} do
 541       followed = insert(:user)
 542
 543       {:ok, current_user} = User.follow(current_user, followed)
 544       assert User.ap_followers(followed) in current_user.following
 545       ActivityPub.follow(current_user, followed)
 546
 547       conn =
 548         conn
 549         |> with_credentials(current_user.nickname, "test")
 550         |> post("/api/friendships/destroy.json", %{user_id: followed.id})
 551
 552       current_user = Repo.get(User, current_user.id)
 553       assert current_user.following == [current_user.ap_id]
 554
 555       assert json_response(conn, 200) ==
 556                UserView.render("show.json", %{user: followed, for: current_user})
 557     end
 558   end
 559
 560   describe "POST /blocks/create.json" do
 561     setup [:valid_user]
 562
 563     test "without valid credentials", %{conn: conn} do
 564       conn = post(conn, "/api/blocks/create.json")
 565       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 566     end
 567
 568     test "with credentials", %{conn: conn, user: current_user} do
 569       blocked = insert(:user)
 570
 571       conn =
 572         conn
 573         |> with_credentials(current_user.nickname, "test")
 574         |> post("/api/blocks/create.json", %{user_id: blocked.id})
 575
 576       current_user = Repo.get(User, current_user.id)
 577       assert User.blocks?(current_user, blocked)
 578
 579       assert json_response(conn, 200) ==
 580                UserView.render("show.json", %{user: blocked, for: current_user})
 581     end
 582   end
 583
 584   describe "POST /blocks/destroy.json" do
 585     setup [:valid_user]
 586
 587     test "without valid credentials", %{conn: conn} do
 588       conn = post(conn, "/api/blocks/destroy.json")
 589       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 590     end
 591
 592     test "with credentials", %{conn: conn, user: current_user} do
 593       blocked = insert(:user)
 594
 595       {:ok, current_user, blocked} = TwitterAPI.block(current_user, %{"user_id" => blocked.id})
 596       assert User.blocks?(current_user, blocked)
 597
 598       conn =
 599         conn
 600         |> with_credentials(current_user.nickname, "test")
 601         |> post("/api/blocks/destroy.json", %{user_id: blocked.id})
 602
 603       current_user = Repo.get(User, current_user.id)
 604       assert current_user.info.blocks == []
 605
 606       assert json_response(conn, 200) ==
 607                UserView.render("show.json", %{user: blocked, for: current_user})
 608     end
 609   end
 610
 611   describe "GET /help/test.json" do
 612     test "returns \"ok\"", %{conn: conn} do
 613       conn = get(conn, "/api/help/test.json")
 614       assert json_response(conn, 200) == "ok"
 615     end
 616   end
 617
 618   describe "POST /api/qvitter/update_avatar.json" do
 619     setup [:valid_user]
 620
 621     test "without valid credentials", %{conn: conn} do
 622       conn = post(conn, "/api/qvitter/update_avatar.json")
 623       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 624     end
 625
 626     test "with credentials", %{conn: conn, user: current_user} do
 627       avatar_image = File.read!("test/fixtures/avatar_data_uri")
 628
 629       conn =
 630         conn
 631         |> with_credentials(current_user.nickname, "test")
 632         |> post("/api/qvitter/update_avatar.json", %{img: avatar_image})
 633
 634       current_user = Repo.get(User, current_user.id)
 635       assert is_map(current_user.avatar)
 636
 637       assert json_response(conn, 200) ==
 638                UserView.render("show.json", %{user: current_user, for: current_user})
 639     end
 640   end
 641
 642   describe "GET /api/qvitter/mutes.json" do
 643     setup [:valid_user]
 644
 645     test "unimplemented mutes without valid credentials", %{conn: conn} do
 646       conn = get(conn, "/api/qvitter/mutes.json")
 647       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 648     end
 649
 650     test "unimplemented mutes with credentials", %{conn: conn, user: current_user} do
 651       conn =
 652         conn
 653         |> with_credentials(current_user.nickname, "test")
 654         |> get("/api/qvitter/mutes.json")
 655
 656       current_user = Repo.get(User, current_user.id)
 657
 658       assert [] = json_response(conn, 200)
 659     end
 660   end
 661
 662   describe "POST /api/favorites/create/:id" do
 663     setup [:valid_user]
 664
 665     test "without valid credentials", %{conn: conn} do
 666       note_activity = insert(:note_activity)
 667       conn = post(conn, "/api/favorites/create/#{note_activity.id}.json")
 668       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 669     end
 670
 671     test "with credentials", %{conn: conn, user: current_user} do
 672       note_activity = insert(:note_activity)
 673
 674       conn =
 675         conn
 676         |> with_credentials(current_user.nickname, "test")
 677         |> post("/api/favorites/create/#{note_activity.id}.json")
 678
 679       assert json_response(conn, 200)
 680     end
 681
 682     test "with credentials, invalid param", %{conn: conn, user: current_user} do
 683       conn =
 684         conn
 685         |> with_credentials(current_user.nickname, "test")
 686         |> post("/api/favorites/create/wrong.json")
 687
 688       assert json_response(conn, 400)
 689     end
 690
 691     test "with credentials, invalid activity", %{conn: conn, user: current_user} do
 692       conn =
 693         conn
 694         |> with_credentials(current_user.nickname, "test")
 695         |> post("/api/favorites/create/1.json")
 696
 697       assert json_response(conn, 500)
 698     end
 699   end
 700
 701   describe "POST /api/favorites/destroy/:id" do
 702     setup [:valid_user]
 703
 704     test "without valid credentials", %{conn: conn} do
 705       note_activity = insert(:note_activity)
 706       conn = post(conn, "/api/favorites/destroy/#{note_activity.id}.json")
 707       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 708     end
 709
 710     test "with credentials", %{conn: conn, user: current_user} do
 711       note_activity = insert(:note_activity)
 712       object = Object.get_by_ap_id(note_activity.data["object"]["id"])
 713       ActivityPub.like(current_user, object)
 714
 715       conn =
 716         conn
 717         |> with_credentials(current_user.nickname, "test")
 718         |> post("/api/favorites/destroy/#{note_activity.id}.json")
 719
 720       assert json_response(conn, 200)
 721     end
 722   end
 723
 724   describe "POST /api/statuses/retweet/:id" do
 725     setup [:valid_user]
 726
 727     test "without valid credentials", %{conn: conn} do
 728       note_activity = insert(:note_activity)
 729       conn = post(conn, "/api/statuses/retweet/#{note_activity.id}.json")
 730       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 731     end
 732
 733     test "with credentials", %{conn: conn, user: current_user} do
 734       note_activity = insert(:note_activity)
 735
 736       request_path = "/api/statuses/retweet/#{note_activity.id}.json"
 737
 738       response =
 739         conn
 740         |> with_credentials(current_user.nickname, "test")
 741         |> post(request_path)
 742
 743       activity = Repo.get(Activity, note_activity.id)
 744       activity_user = Repo.get_by(User, ap_id: note_activity.data["actor"])
 745
 746       assert json_response(response, 200) ==
 747                ActivityRepresenter.to_map(activity, %{user: activity_user, for: current_user})
 748     end
 749   end
 750
 751   describe "POST /api/statuses/unretweet/:id" do
 752     setup [:valid_user]
 753
 754     test "without valid credentials", %{conn: conn} do
 755       note_activity = insert(:note_activity)
 756       conn = post(conn, "/api/statuses/unretweet/#{note_activity.id}.json")
 757       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
 758     end
 759
 760     test "with credentials", %{conn: conn, user: current_user} do
 761       note_activity = insert(:note_activity)
 762
 763       request_path = "/api/statuses/retweet/#{note_activity.id}.json"
 764
 765       _response =
 766         conn
 767         |> with_credentials(current_user.nickname, "test")
 768         |> post(request_path)
 769
 770       request_path = String.replace(request_path, "retweet", "unretweet")
 771
 772       response =
 773         conn
 774         |> with_credentials(current_user.nickname, "test")
 775         |> post(request_path)
 776
 777       activity = Repo.get(Activity, note_activity.id)
 778       activity_user = Repo.get_by(User, ap_id: note_activity.data["actor"])
 779
 780       assert json_response(response, 200) ==
 781                ActivityRepresenter.to_map(activity, %{user: activity_user, for: current_user})
 782     end
 783   end
 784
 785   describe "POST /api/account/register" do
 786     test "it creates a new user", %{conn: conn} do
 787       data = %{
 788         "nickname" => "lain",
 789         "email" => "lain@wired.jp",
 790         "fullname" => "lain iwakura",
 791         "bio" => "close the world.",
 792         "password" => "bear",
 793         "confirm" => "bear"
 794       }
 795
 796       conn =
 797         conn
 798         |> post("/api/account/register", data)
 799
 800       user = json_response(conn, 200)
 801
 802       fetched_user = Repo.get_by(User, nickname: "lain")
 803       assert user == UserView.render("show.json", %{user: fetched_user})
 804     end
 805
 806     test "it returns errors on a problem", %{conn: conn} do
 807       data = %{
 808         "email" => "lain@wired.jp",
 809         "fullname" => "lain iwakura",
 810         "bio" => "close the world.",
 811         "password" => "bear",
 812         "confirm" => "bear"
 813       }
 814
 815       conn =
 816         conn
 817         |> post("/api/account/register", data)
 818
 819       errors = json_response(conn, 400)
 820
 821       assert is_binary(errors["error"])
 822     end
 823   end
 824
 825   describe "GET /api/externalprofile/show" do
 826     test "it returns the user", %{conn: conn} do
 827       user = insert(:user)
 828       other_user = insert(:user)
 829
 830       conn =
 831         conn
 832         |> assign(:user, user)
 833         |> get("/api/externalprofile/show", %{profileurl: other_user.ap_id})
 834
 835       assert json_response(conn, 200) == UserView.render("show.json", %{user: other_user})
 836     end
 837   end
 838
 839   describe "GET /api/statuses/followers" do
 840     test "it returns a user's followers", %{conn: conn} do
 841       user = insert(:user)
 842       follower_one = insert(:user)
 843       follower_two = insert(:user)
 844       _not_follower = insert(:user)
 845
 846       {:ok, follower_one} = User.follow(follower_one, user)
 847       {:ok, follower_two} = User.follow(follower_two, user)
 848
 849       conn =
 850         conn
 851         |> assign(:user, user)
 852         |> get("/api/statuses/followers")
 853
 854       expected = UserView.render("index.json", %{users: [follower_one, follower_two], for: user})
 855       result = json_response(conn, 200)
 856       assert Enum.sort(expected) == Enum.sort(result)
 857     end
 858
 859     test "it returns a given user's followers with user_id", %{conn: conn} do
 860       user = insert(:user)
 861       follower_one = insert(:user)
 862       follower_two = insert(:user)
 863       not_follower = insert(:user)
 864
 865       {:ok, follower_one} = User.follow(follower_one, user)
 866       {:ok, follower_two} = User.follow(follower_two, user)
 867
 868       conn =
 869         conn
 870         |> assign(:user, not_follower)
 871         |> get("/api/statuses/followers", %{"user_id" => user.id})
 872
 873       assert MapSet.equal?(
 874                MapSet.new(json_response(conn, 200)),
 875                MapSet.new(
 876                  UserView.render("index.json", %{
 877                    users: [follower_one, follower_two],
 878                    for: not_follower
 879                  })
 880                )
 881              )
 882     end
 883
 884     test "it returns empty for a hidden network", %{conn: conn} do
 885       user = insert(:user, %{info: %{hide_network: true}})
 886       follower_one = insert(:user)
 887       follower_two = insert(:user)
 888       not_follower = insert(:user)
 889
 890       {:ok, follower_one} = User.follow(follower_one, user)
 891       {:ok, follower_two} = User.follow(follower_two, user)
 892
 893       conn =
 894         conn
 895         |> assign(:user, not_follower)
 896         |> get("/api/statuses/followers", %{"user_id" => user.id})
 897
 898       assert [] == json_response(conn, 200)
 899     end
 900
 901     test "it returns the followers for a hidden network if requested by the user themselves", %{
 902       conn: conn
 903     } do
 904       user = insert(:user, %{info: %{hide_network: true}})
 905       follower_one = insert(:user)
 906       follower_two = insert(:user)
 907       not_follower = insert(:user)
 908
 909       {:ok, follower_one} = User.follow(follower_one, user)
 910       {:ok, follower_two} = User.follow(follower_two, user)
 911
 912       conn =
 913         conn
 914         |> assign(:user, user)
 915         |> get("/api/statuses/followers", %{"user_id" => user.id})
 916
 917       refute [] == json_response(conn, 200)
 918     end
 919   end
 920
 921   describe "GET /api/statuses/friends" do
 922     test "it returns the logged in user's friends", %{conn: conn} do
 923       user = insert(:user)
 924       followed_one = insert(:user)
 925       followed_two = insert(:user)
 926       _not_followed = insert(:user)
 927
 928       {:ok, user} = User.follow(user, followed_one)
 929       {:ok, user} = User.follow(user, followed_two)
 930
 931       conn =
 932         conn
 933         |> assign(:user, user)
 934         |> get("/api/statuses/friends")
 935
 936       expected = UserView.render("index.json", %{users: [followed_one, followed_two], for: user})
 937       result = json_response(conn, 200)
 938       assert Enum.sort(expected) == Enum.sort(result)
 939     end
 940
 941     test "it returns a given user's friends with user_id", %{conn: conn} do
 942       user = insert(:user)
 943       followed_one = insert(:user)
 944       followed_two = insert(:user)
 945       _not_followed = insert(:user)
 946
 947       {:ok, user} = User.follow(user, followed_one)
 948       {:ok, user} = User.follow(user, followed_two)
 949
 950       conn =
 951         conn
 952         |> assign(:user, user)
 953         |> get("/api/statuses/friends", %{"user_id" => user.id})
 954
 955       assert MapSet.equal?(
 956                MapSet.new(json_response(conn, 200)),
 957                MapSet.new(
 958                  UserView.render("index.json", %{users: [followed_one, followed_two], for: user})
 959                )
 960              )
 961     end
 962
 963     test "it returns empty for a hidden network", %{conn: conn} do
 964       user = insert(:user, %{info: %{hide_network: true}})
 965       followed_one = insert(:user)
 966       followed_two = insert(:user)
 967       not_followed = insert(:user)
 968
 969       {:ok, user} = User.follow(user, followed_one)
 970       {:ok, user} = User.follow(user, followed_two)
 971
 972       conn =
 973         conn
 974         |> assign(:user, not_followed)
 975         |> get("/api/statuses/friends", %{"user_id" => user.id})
 976
 977       assert [] == json_response(conn, 200)
 978     end
 979
 980     test "it returns friends for a hidden network if the user themselves request it", %{
 981       conn: conn
 982     } do
 983       user = insert(:user, %{info: %{hide_network: true}})
 984       followed_one = insert(:user)
 985       followed_two = insert(:user)
 986       not_followed = insert(:user)
 987
 988       {:ok, user} = User.follow(user, followed_one)
 989       {:ok, user} = User.follow(user, followed_two)
 990
 991       conn =
 992         conn
 993         |> assign(:user, user)
 994         |> get("/api/statuses/friends", %{"user_id" => user.id})
 995
 996       refute [] == json_response(conn, 200)
 997     end
 998
 999     test "it returns a given user's friends with screen_name", %{conn: conn} do
1000       user = insert(:user)
1001       followed_one = insert(:user)
1002       followed_two = insert(:user)
1003       _not_followed = insert(:user)
1004
1005       {:ok, user} = User.follow(user, followed_one)
1006       {:ok, user} = User.follow(user, followed_two)
1007
1008       conn =
1009         conn
1010         |> assign(:user, user)
1011         |> get("/api/statuses/friends", %{"screen_name" => user.nickname})
1012
1013       assert MapSet.equal?(
1014                MapSet.new(json_response(conn, 200)),
1015                MapSet.new(
1016                  UserView.render("index.json", %{users: [followed_one, followed_two], for: user})
1017                )
1018              )
1019     end
1020   end
1021
1022   describe "GET /friends/ids" do
1023     test "it returns a user's friends", %{conn: conn} do
1024       user = insert(:user)
1025       followed_one = insert(:user)
1026       followed_two = insert(:user)
1027       _not_followed = insert(:user)
1028
1029       {:ok, user} = User.follow(user, followed_one)
1030       {:ok, user} = User.follow(user, followed_two)
1031
1032       conn =
1033         conn
1034         |> assign(:user, user)
1035         |> get("/api/friends/ids")
1036
1037       expected = [followed_one.id, followed_two.id]
1038
1039       assert MapSet.equal?(
1040                MapSet.new(Poison.decode!(json_response(conn, 200))),
1041                MapSet.new(expected)
1042              )
1043     end
1044   end
1045
1046   describe "POST /api/account/update_profile.json" do
1047     test "it updates a user's profile", %{conn: conn} do
1048       user = insert(:user)
1049
1050       conn =
1051         conn
1052         |> assign(:user, user)
1053         |> post("/api/account/update_profile.json", %{
1054           "name" => "new name",
1055           "description" => "new description"
1056         })
1057
1058       user = Repo.get!(User, user.id)
1059       assert user.name == "new name"
1060       assert user.bio == "new description"
1061
1062       assert json_response(conn, 200) == UserView.render("user.json", %{user: user, for: user})
1063     end
1064
1065     test "it sets and un-sets hide_network", %{conn: conn} do
1066       user = insert(:user)
1067
1068       conn
1069       |> assign(:user, user)
1070       |> post("/api/account/update_profile.json", %{
1071         "hide_network" => "true"
1072       })
1073
1074       user = Repo.get!(User, user.id)
1075       assert user.info.hide_network == true
1076
1077       conn =
1078         conn
1079         |> assign(:user, user)
1080         |> post("/api/account/update_profile.json", %{
1081           "hide_network" => "false"
1082         })
1083
1084       user = Repo.get!(User, user.id)
1085       assert user.info.hide_network == false
1086       assert json_response(conn, 200) == UserView.render("user.json", %{user: user, for: user})
1087     end
1088
1089     test "it locks an account", %{conn: conn} do
1090       user = insert(:user)
1091
1092       conn =
1093         conn
1094         |> assign(:user, user)
1095         |> post("/api/account/update_profile.json", %{
1096           "locked" => "true"
1097         })
1098
1099       user = Repo.get!(User, user.id)
1100       assert user.info.locked == true
1101
1102       assert json_response(conn, 200) == UserView.render("user.json", %{user: user, for: user})
1103     end
1104
1105     test "it unlocks an account", %{conn: conn} do
1106       user = insert(:user)
1107
1108       conn =
1109         conn
1110         |> assign(:user, user)
1111         |> post("/api/account/update_profile.json", %{
1112           "locked" => "false"
1113         })
1114
1115       user = Repo.get!(User, user.id)
1116       assert user.info.locked == false
1117
1118       assert json_response(conn, 200) == UserView.render("user.json", %{user: user, for: user})
1119     end
1120   end
1121
1122   defp valid_user(_context) do
1123     user = insert(:user)
1124     [user: user]
1125   end
1126
1127   defp with_credentials(conn, username, password) do
1128     header_content = "Basic " <> Base.encode64("#{username}:#{password}")
1129     put_req_header(conn, "authorization", header_content)
1130   end
1131
1132   describe "GET /api/search.json" do
1133     test "it returns search results", %{conn: conn} do
1134       user = insert(:user)
1135       user_two = insert(:user, %{nickname: "shp@shitposter.club"})
1136
1137       {:ok, activity} = CommonAPI.post(user, %{"status" => "This is about 2hu"})
1138       {:ok, _} = CommonAPI.post(user_two, %{"status" => "This isn't"})
1139
1140       conn =
1141         conn
1142         |> get("/api/search.json", %{"q" => "2hu", "page" => "1", "rpp" => "1"})
1143
1144       assert [status] = json_response(conn, 200)
1145       assert status["id"] == activity.id
1146     end
1147   end
1148
1149   describe "GET /api/statusnet/tags/timeline/:tag.json" do
1150     test "it returns the tags timeline", %{conn: conn} do
1151       user = insert(:user)
1152       user_two = insert(:user, %{nickname: "shp@shitposter.club"})
1153
1154       {:ok, activity} = CommonAPI.post(user, %{"status" => "This is about #2hu"})
1155       {:ok, _} = CommonAPI.post(user_two, %{"status" => "This isn't"})
1156
1157       conn =
1158         conn
1159         |> get("/api/statusnet/tags/timeline/2hu.json")
1160
1161       assert [status] = json_response(conn, 200)
1162       assert status["id"] == activity.id
1163     end
1164   end
1165
1166   test "Convert newlines to <br> in bio", %{conn: conn} do
1167     user = insert(:user)
1168
1169     _conn =
1170       conn
1171       |> assign(:user, user)
1172       |> post("/api/account/update_profile.json", %{
1173         "description" => "Hello,\r\nWorld! I\n am a test."
1174       })
1175
1176     user = Repo.get!(User, user.id)
1177     assert user.bio == "Hello,<br>World! I<br> am a test."
1178   end
1179
1180   describe "POST /api/pleroma/change_password" do
1181     setup [:valid_user]
1182
1183     test "without credentials", %{conn: conn} do
1184       conn = post(conn, "/api/pleroma/change_password")
1185       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
1186     end
1187
1188     test "with credentials and invalid password", %{conn: conn, user: current_user} do
1189       conn =
1190         conn
1191         |> with_credentials(current_user.nickname, "test")
1192         |> post("/api/pleroma/change_password", %{
1193           "password" => "hi",
1194           "new_password" => "newpass",
1195           "new_password_confirmation" => "newpass"
1196         })
1197
1198       assert json_response(conn, 200) == %{"error" => "Invalid password."}
1199     end
1200
1201     test "with credentials, valid password and new password and confirmation not matching", %{
1202       conn: conn,
1203       user: current_user
1204     } do
1205       conn =
1206         conn
1207         |> with_credentials(current_user.nickname, "test")
1208         |> post("/api/pleroma/change_password", %{
1209           "password" => "test",
1210           "new_password" => "newpass",
1211           "new_password_confirmation" => "notnewpass"
1212         })
1213
1214       assert json_response(conn, 200) == %{
1215                "error" => "New password does not match confirmation."
1216              }
1217     end
1218
1219     test "with credentials, valid password and invalid new password", %{
1220       conn: conn,
1221       user: current_user
1222     } do
1223       conn =
1224         conn
1225         |> with_credentials(current_user.nickname, "test")
1226         |> post("/api/pleroma/change_password", %{
1227           "password" => "test",
1228           "new_password" => "",
1229           "new_password_confirmation" => ""
1230         })
1231
1232       assert json_response(conn, 200) == %{
1233                "error" => "New password can't be blank."
1234              }
1235     end
1236
1237     test "with credentials, valid password and matching new password and confirmation", %{
1238       conn: conn,
1239       user: current_user
1240     } do
1241       conn =
1242         conn
1243         |> with_credentials(current_user.nickname, "test")
1244         |> post("/api/pleroma/change_password", %{
1245           "password" => "test",
1246           "new_password" => "newpass",
1247           "new_password_confirmation" => "newpass"
1248         })
1249
1250       assert json_response(conn, 200) == %{"status" => "success"}
1251       fetched_user = Repo.get(User, current_user.id)
1252       assert Pbkdf2.checkpw("newpass", fetched_user.password_hash) == true
1253     end
1254   end
1255
1256   describe "POST /api/pleroma/delete_account" do
1257     setup [:valid_user]
1258
1259     test "without credentials", %{conn: conn} do
1260       conn = post(conn, "/api/pleroma/delete_account")
1261       assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
1262     end
1263
1264     test "with credentials and invalid password", %{conn: conn, user: current_user} do
1265       conn =
1266         conn
1267         |> with_credentials(current_user.nickname, "test")
1268         |> post("/api/pleroma/delete_account", %{"password" => "hi"})
1269
1270       assert json_response(conn, 200) == %{"error" => "Invalid password."}
1271     end
1272
1273     test "with credentials and valid password", %{conn: conn, user: current_user} do
1274       conn =
1275         conn
1276         |> with_credentials(current_user.nickname, "test")
1277         |> post("/api/pleroma/delete_account", %{"password" => "test"})
1278
1279       assert json_response(conn, 200) == %{"status" => "success"}
1280       # Wait a second for the started task to end
1281       :timer.sleep(1000)
1282     end
1283   end
1284
1285   describe "GET /api/pleroma/friend_requests" do
1286     test "it lists friend requests" do
1287       user = insert(:user)
1288       other_user = insert(:user)
1289
1290       {:ok, _activity} = ActivityPub.follow(other_user, user)
1291
1292       user = Repo.get(User, user.id)
1293       other_user = Repo.get(User, other_user.id)
1294
1295       assert User.following?(other_user, user) == false
1296
1297       conn =
1298         build_conn()
1299         |> assign(:user, user)
1300         |> get("/api/pleroma/friend_requests")
1301
1302       assert [relationship] = json_response(conn, 200)
1303       assert other_user.id == relationship["id"]
1304     end
1305   end
1306
1307   describe "POST /api/pleroma/friendships/approve" do
1308     test "it approves a friend request" do
1309       user = insert(:user)
1310       other_user = insert(:user)
1311
1312       {:ok, _activity} = ActivityPub.follow(other_user, user)
1313
1314       user = Repo.get(User, user.id)
1315       other_user = Repo.get(User, other_user.id)
1316
1317       assert User.following?(other_user, user) == false
1318
1319       conn =
1320         build_conn()
1321         |> assign(:user, user)
1322         |> post("/api/pleroma/friendships/approve", %{"user_id" => to_string(other_user.id)})
1323
1324       assert relationship = json_response(conn, 200)
1325       assert other_user.id == relationship["id"]
1326       assert relationship["follows_you"] == true
1327     end
1328   end
1329
1330   describe "POST /api/pleroma/friendships/deny" do
1331     test "it denies a friend request" do
1332       user = insert(:user)
1333       other_user = insert(:user)
1334
1335       {:ok, _activity} = ActivityPub.follow(other_user, user)
1336
1337       user = Repo.get(User, user.id)
1338       other_user = Repo.get(User, other_user.id)
1339
1340       assert User.following?(other_user, user) == false
1341
1342       conn =
1343         build_conn()
1344         |> assign(:user, user)
1345         |> post("/api/pleroma/friendships/deny", %{"user_id" => to_string(other_user.id)})
1346
1347       assert relationship = json_response(conn, 200)
1348       assert other_user.id == relationship["id"]
1349       assert relationship["follows_you"] == false
1350     end
1351   end
1352
1353   describe "GET /api/pleroma/search_user" do
1354     test "it returns users, ordered by similarity", %{conn: conn} do
1355       user = insert(:user, %{name: "eal"})
1356       user_two = insert(:user, %{name: "ean"})
1357       user_three = insert(:user, %{name: "ebn"})
1358
1359       resp =
1360         conn
1361         |> get(twitter_api_search__path(conn, :search_user), query: "eal")
1362         |> json_response(200)
1363
1364       assert length(resp) == 3
1365       assert [user.id, user_two.id, user_three.id] == Enum.map(resp, fn %{"id" => id} -> id end)
1366     end
1367   end
1368 end