+ test "redirects to json if requested", %{conn: conn, user: user} do
+ {:ok, activity} = CommonAPI.post(user, %{status: "testing a thing!"})
+
+ conn =
+ conn
+ |> put_req_header(
+ "accept",
+ "Accept: application/activity+json, application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\", text/html"
+ )
+ |> get("/notice/#{activity.id}")
+
+ assert redirected_to(conn, 302) =~ activity.data["object"]
+ end
+
+ test "filters HTML tags", %{conn: conn} do
+ user = insert(:user)
+ {:ok, activity} = CommonAPI.post(user, %{status: "<script>alert('xss')</script>"})
+
+ conn =
+ conn
+ |> put_req_header("accept", "text/html")
+ |> get("/notice/#{activity.id}")
+
+ html = html_response(conn, 200)
+ assert html =~ ~s[<script>alert('xss')</script>]
+ end
+
+ test "shows the whole thread", %{conn: conn, user: user} do
+ {:ok, activity} = CommonAPI.post(user, %{status: "space: the final frontier"})
+
+ CommonAPI.post(user, %{
+ status: "these are the voyages or something",
+ in_reply_to_status_id: activity.id
+ })
+
+ conn = get(conn, "/notice/#{activity.id}")
+
+ html = html_response(conn, 200)
+ assert html =~ "the final frontier"
+ assert html =~ "voyages"
+ end
+
+ test "redirect by AP object ID", %{conn: conn, user: user} do
+ {:ok, %Activity{data: %{"object" => object_url}}} =
+ CommonAPI.post(user, %{status: "beam me up"})
+
+ conn = get(conn, URI.parse(object_url).path)
+
+ assert html_response(conn, 302) =~ "redirected"
+ end
+
+ test "redirect by activity ID", %{conn: conn, user: user} do
+ {:ok, %Activity{data: %{"id" => id}}} =
+ CommonAPI.post(user, %{status: "I'm a doctor, not a devops!"})
+
+ conn = get(conn, URI.parse(id).path)
+
+ assert html_response(conn, 302) =~ "redirected"
+ end
+