# Pleroma: A lightweight social networking server
-# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
# SPDX-License-Identifier: AGPL-3.0-only
defmodule Pleroma.Web.MastodonAPI.TimelineControllerTest do
alias Pleroma.User
alias Pleroma.Web.CommonAPI
- clear_config([:instance, :public])
-
setup do
mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
:ok
end
describe "home" do
- test "the home timeline", %{conn: conn} do
- user = insert(:user)
- following = insert(:user)
+ setup do: oauth_access(["read:statuses"])
- {:ok, _activity} = CommonAPI.post(following, %{"status" => "test"})
+ test "does NOT render account/pleroma/relationship by default", %{
+ user: user,
+ conn: conn
+ } do
+ other_user = insert(:user)
+
+ {:ok, _} = CommonAPI.post(other_user, %{"status" => "hi @#{user.nickname}"})
- conn =
+ response =
conn
|> assign(:user, user)
|> get("/api/v1/timelines/home")
+ |> json_response(200)
- assert Enum.empty?(json_response(conn, :ok))
-
- {:ok, user} = User.follow(user, following)
-
- conn =
- build_conn()
- |> assign(:user, user)
- |> get("/api/v1/timelines/home")
+ assert Enum.all?(response, fn n ->
+ get_in(n, ["account", "pleroma", "relationship"]) == %{}
+ end)
+ end
- assert [%{"content" => "test"}] = json_response(conn, :ok)
+ test "embeds account relationships with `with_relationships=true`", %{user: user, conn: conn} do
+ uri = "/api/v1/timelines/home?with_relationships=true"
+
+ following = insert(:user, nickname: "followed")
+ third_user = insert(:user, nickname: "repeated")
+
+ {:ok, _activity} = CommonAPI.post(following, %{"status" => "post"})
+ {:ok, activity} = CommonAPI.post(third_user, %{"status" => "repeated post"})
+ {:ok, _, _} = CommonAPI.repeat(activity.id, following)
+
+ ret_conn = get(conn, uri)
+
+ assert Enum.empty?(json_response(ret_conn, :ok))
+
+ {:ok, _user} = User.follow(user, following)
+
+ ret_conn = get(conn, uri)
+
+ assert [
+ %{
+ "reblog" => %{
+ "content" => "repeated post",
+ "account" => %{
+ "pleroma" => %{
+ "relationship" => %{"following" => false, "followed_by" => false}
+ }
+ }
+ },
+ "account" => %{
+ "pleroma" => %{
+ "relationship" => %{"following" => true}
+ }
+ }
+ },
+ %{
+ "content" => "post",
+ "account" => %{
+ "acct" => "followed",
+ "pleroma" => %{
+ "relationship" => %{"following" => true}
+ }
+ }
+ }
+ ] = json_response(ret_conn, :ok)
+
+ {:ok, _user} = User.follow(third_user, user)
+
+ ret_conn = get(conn, uri)
+
+ assert [
+ %{
+ "reblog" => %{
+ "content" => "repeated post",
+ "account" => %{
+ "acct" => "repeated",
+ "pleroma" => %{
+ "relationship" => %{"following" => false, "followed_by" => true}
+ }
+ }
+ },
+ "account" => %{
+ "pleroma" => %{
+ "relationship" => %{"following" => true}
+ }
+ }
+ },
+ %{
+ "content" => "post",
+ "account" => %{
+ "acct" => "followed",
+ "pleroma" => %{
+ "relationship" => %{"following" => true}
+ }
+ }
+ }
+ ] = json_response(ret_conn, :ok)
end
- test "the home timeline when the direct messages are excluded", %{conn: conn} do
- user = insert(:user)
+ test "the home timeline when the direct messages are excluded", %{user: user, conn: conn} do
{:ok, public_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "public"})
{:ok, direct_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "direct"})
{:ok, private_activity} =
CommonAPI.post(user, %{"status" => ".", "visibility" => "private"})
- conn =
- conn
- |> assign(:user, user)
- |> get("/api/v1/timelines/home", %{"exclude_visibilities" => ["direct"]})
+ conn = get(conn, "/api/v1/timelines/home", %{"exclude_visibilities" => ["direct"]})
assert status_ids = json_response(conn, :ok) |> Enum.map(& &1["id"])
assert public_activity.id in status_ids
assert [%{"content" => "test"}] = json_response(conn, :ok)
end
- test "the public timeline when public is set to false", %{conn: conn} do
- Config.put([:instance, :public], false)
-
- assert %{"error" => "This resource requires authentication."} ==
- conn
- |> get("/api/v1/timelines/public", %{"local" => "False"})
- |> json_response(:forbidden)
- end
-
test "the public timeline includes only public statuses for an authenticated user" do
- user = insert(:user)
-
- conn =
- build_conn()
- |> assign(:user, user)
+ %{user: user, conn: conn} = oauth_access(["read:statuses"])
{:ok, _activity} = CommonAPI.post(user, %{"status" => "test"})
{:ok, _activity} = CommonAPI.post(user, %{"status" => "test", "visibility" => "private"})
end
end
+ defp local_and_remote_activities do
+ insert(:note_activity)
+ insert(:note_activity, local: false)
+ :ok
+ end
+
+ describe "public with restrict unauthenticated timeline for local and federated timelines" do
+ setup do: local_and_remote_activities()
+
+ setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
+
+ setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
+
+ test "if user is unauthenticated", %{conn: conn} do
+ res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
+
+ assert json_response(res_conn, :unauthorized) == %{
+ "error" => "authorization required for timeline view"
+ }
+
+ res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
+
+ assert json_response(res_conn, :unauthorized) == %{
+ "error" => "authorization required for timeline view"
+ }
+ end
+
+ test "if user is authenticated" do
+ %{conn: conn} = oauth_access(["read:statuses"])
+
+ res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
+ assert length(json_response(res_conn, 200)) == 1
+
+ res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
+ assert length(json_response(res_conn, 200)) == 2
+ end
+ end
+
+ describe "public with restrict unauthenticated timeline for local" do
+ setup do: local_and_remote_activities()
+
+ setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
+
+ test "if user is unauthenticated", %{conn: conn} do
+ res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
+
+ assert json_response(res_conn, :unauthorized) == %{
+ "error" => "authorization required for timeline view"
+ }
+
+ res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
+ assert length(json_response(res_conn, 200)) == 2
+ end
+
+ test "if user is authenticated", %{conn: _conn} do
+ %{conn: conn} = oauth_access(["read:statuses"])
+
+ res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
+ assert length(json_response(res_conn, 200)) == 1
+
+ res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
+ assert length(json_response(res_conn, 200)) == 2
+ end
+ end
+
+ describe "public with restrict unauthenticated timeline for remote" do
+ setup do: local_and_remote_activities()
+
+ setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
+
+ test "if user is unauthenticated", %{conn: conn} do
+ res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
+ assert length(json_response(res_conn, 200)) == 1
+
+ res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
+
+ assert json_response(res_conn, :unauthorized) == %{
+ "error" => "authorization required for timeline view"
+ }
+ end
+
+ test "if user is authenticated", %{conn: _conn} do
+ %{conn: conn} = oauth_access(["read:statuses"])
+
+ res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "true"})
+ assert length(json_response(res_conn, 200)) == 1
+
+ res_conn = get(conn, "/api/v1/timelines/public", %{"local" => "false"})
+ assert length(json_response(res_conn, 200)) == 2
+ end
+ end
+
describe "direct" do
test "direct timeline", %{conn: conn} do
user_one = insert(:user)
"visibility" => "private"
})
- # Only direct should be visible here
- res_conn =
+ conn_user_two =
conn
|> assign(:user, user_two)
- |> get("api/v1/timelines/direct")
+ |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
+
+ # Only direct should be visible here
+ res_conn = get(conn_user_two, "api/v1/timelines/direct")
[status] = json_response(res_conn, :ok)
res_conn =
build_conn()
|> assign(:user, user_one)
+ |> assign(:token, insert(:oauth_token, user: user_one, scopes: ["read:statuses"]))
|> get("api/v1/timelines/direct")
[status] = json_response(res_conn, :ok)
assert %{"visibility" => "direct"} = status
# Both should be visible here
- res_conn =
- conn
- |> assign(:user, user_two)
- |> get("api/v1/timelines/home")
+ res_conn = get(conn_user_two, "api/v1/timelines/home")
[_s1, _s2] = json_response(res_conn, :ok)
})
end)
- res_conn =
- conn
- |> assign(:user, user_two)
- |> get("api/v1/timelines/direct")
+ res_conn = get(conn_user_two, "api/v1/timelines/direct")
statuses = json_response(res_conn, :ok)
assert length(statuses) == 20
res_conn =
- conn
- |> assign(:user, user_two)
- |> get("api/v1/timelines/direct", %{max_id: List.last(statuses)["id"]})
+ get(conn_user_two, "api/v1/timelines/direct", %{max_id: List.last(statuses)["id"]})
[status] = json_response(res_conn, :ok)
assert status["url"] != direct.data["id"]
end
- test "doesn't include DMs from blocked users", %{conn: conn} do
- blocker = insert(:user)
+ test "doesn't include DMs from blocked users" do
+ %{user: blocker, conn: conn} = oauth_access(["read:statuses"])
blocked = insert(:user)
- user = insert(:user)
+ other_user = insert(:user)
{:ok, _user_relationship} = User.block(blocker, blocked)
{:ok, _blocked_direct} =
})
{:ok, direct} =
- CommonAPI.post(user, %{
+ CommonAPI.post(other_user, %{
"status" => "Hi @#{blocker.nickname}!",
"visibility" => "direct"
})
- res_conn =
- conn
- |> assign(:user, user)
- |> get("api/v1/timelines/direct")
+ res_conn = get(conn, "api/v1/timelines/direct")
[status] = json_response(res_conn, :ok)
assert status["id"] == direct.id
end
describe "list" do
- test "list timeline", %{conn: conn} do
- user = insert(:user)
+ setup do: oauth_access(["read:lists"])
+
+ test "list timeline", %{user: user, conn: conn} do
other_user = insert(:user)
{:ok, _activity_one} = CommonAPI.post(user, %{"status" => "Marisa is cute."})
{:ok, activity_two} = CommonAPI.post(other_user, %{"status" => "Marisa is cute."})
{:ok, list} = Pleroma.List.create("name", user)
{:ok, list} = Pleroma.List.follow(list, other_user)
- conn =
- conn
- |> assign(:user, user)
- |> get("/api/v1/timelines/list/#{list.id}")
+ conn = get(conn, "/api/v1/timelines/list/#{list.id}")
assert [%{"id" => id}] = json_response(conn, :ok)
assert id == to_string(activity_two.id)
end
- test "list timeline does not leak non-public statuses for unfollowed users", %{conn: conn} do
- user = insert(:user)
+ test "list timeline does not leak non-public statuses for unfollowed users", %{
+ user: user,
+ conn: conn
+ } do
other_user = insert(:user)
{:ok, activity_one} = CommonAPI.post(other_user, %{"status" => "Marisa is cute."})
{:ok, list} = Pleroma.List.create("name", user)
{:ok, list} = Pleroma.List.follow(list, other_user)
- conn =
- conn
- |> assign(:user, user)
- |> get("/api/v1/timelines/list/#{list.id}")
+ conn = get(conn, "/api/v1/timelines/list/#{list.id}")
assert [%{"id" => id}] = json_response(conn, :ok)
end
describe "hashtag" do
+ setup do: oauth_access(["n/a"])
+
@tag capture_log: true
test "hashtag timeline", %{conn: conn} do
following = insert(:user)
projects / akkoma / blobdiff