X-Git-Url: https://git.squeep.com/?a=blobdiff_plain;f=test%2Fweb%2Ftwitter_api%2Fremote_follow_controller_test.exs;h=80a42989d6f2cec9b99722250072f39f029907b3;hb=2019f3b3ff365b61c14f01c736a6dcb68cb36624;hp=3f26a889db0a539ebcee96eedc3f7893104bc767;hpb=bdd71669da43698716be6494528b6e1813d0cd3d;p=akkoma

diff --git a/test/web/twitter_api/remote_follow_controller_test.exs b/test/web/twitter_api/remote_follow_controller_test.exs
index 3f26a889d..80a42989d 100644
--- a/test/web/twitter_api/remote_follow_controller_test.exs
+++ b/test/web/twitter_api/remote_follow_controller_test.exs
@@ -1,5 +1,5 @@
 # Pleroma: A lightweight social networking server
-# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
 # SPDX-License-Identifier: AGPL-3.0-only
 
 defmodule Pleroma.Web.TwitterAPI.RemoteFollowControllerTest do
@@ -70,19 +70,35 @@ defmodule Pleroma.Web.TwitterAPI.RemoteFollowControllerTest do
     end
   end
 
-  describe "POST /ostatus_subscribe - do_remote_follow/2 with assigned user " do
+  describe "POST /ostatus_subscribe - do_follow/2 with assigned user " do
+    test "required `follow | write:follows` scope", %{conn: conn} do
+      user = insert(:user)
+      user2 = insert(:user)
+      read_token = insert(:oauth_token, user: user, scopes: ["read"])
+
+      assert capture_log(fn ->
+               response =
+                 conn
+                 |> assign(:user, user)
+                 |> assign(:token, read_token)
+                 |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
+                 |> response(200)
+
+               assert response =~ "Error following account"
+             end) =~ "Insufficient permissions: follow | write:follows."
+    end
+
     test "follows user", %{conn: conn} do
       user = insert(:user)
       user2 = insert(:user)
 
-      response =
+      conn =
         conn
         |> assign(:user, user)
+        |> assign(:token, insert(:oauth_token, user: user, scopes: ["write:follows"]))
         |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
-        |> response(200)
 
-      assert response =~ "Account followed!"
-      assert user2.follower_address in User.following(user)
+      assert redirected_to(conn) == "/users/#{user2.id}"
     end
 
     test "returns error when user is deactivated", %{conn: conn} do
@@ -131,29 +147,28 @@ defmodule Pleroma.Web.TwitterAPI.RemoteFollowControllerTest do
       user2 = insert(:user)
       {:ok, _, _, _} = CommonAPI.follow(user, user2)
 
-      response =
+      conn =
         conn
         |> assign(:user, refresh_record(user))
+        |> assign(:token, insert(:oauth_token, user: user, scopes: ["write:follows"]))
         |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
-        |> response(200)
 
-      assert response =~ "Account followed!"
+      assert redirected_to(conn) == "/users/#{user2.id}"
     end
   end
 
-  describe "POST /ostatus_subscribe - do_remote_follow/2 without assigned user " do
+  describe "POST /ostatus_subscribe - follow/2 without assigned user " do
     test "follows", %{conn: conn} do
       user = insert(:user)
       user2 = insert(:user)
 
-      response =
+      conn =
         conn
         |> post(remote_follow_path(conn, :do_follow), %{
           "authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
         })
-        |> response(200)
 
-      assert response =~ "Account followed!"
+      assert redirected_to(conn) == "/users/#{user2.id}"
       assert user2.follower_address in User.following(user)
     end