Merge remote-tracking branch 'parent/main' into upstream-20250328

spec/requests/activitypub/collections_spec.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'ActivityPub Collections' do
+  let!(:account) { Fabricate(:account) }
+  let!(:private_pinned) { Fabricate(:status, account: account, text: 'secret private stuff', visibility: :private) }
+  let(:remote_account) { nil }
+
+  before do
+    Fabricate.times(2, :status_pin, account: account)
+    Fabricate(:status_pin, account: account, status: private_pinned)
+    Fabricate(:status, account: account, visibility: :private)
+  end
+
+  describe 'GET #show' do
+    subject { get account_collection_path(id: id, account_username: account.username), headers: nil, sign_with: remote_account }
+
+    context 'when id is "featured"' do
+      let(:id) { 'featured' }
+
+      context 'without signature' do
+        let(:remote_account) { nil }
+
+        it 'returns http success and correct media type and correct items' do
+          subject
+
+          expect(response)
+            .to have_http_status(200)
+            .and have_cacheable_headers
+          expect(response.media_type)
+            .to eq 'application/activity+json'
+
+          expect(response.parsed_body[:orderedItems])
+            .to be_an(Array)
+            .and have_attributes(size: 3)
+            .and include(ActivityPub::TagManager.instance.uri_for(private_pinned))
+            .and not_include(private_pinned.text)
+        end
+
+        context 'when account is permanently suspended' do
+          before do
+            account.suspend!
+            account.deletion_request.destroy
+          end
+
+          it 'returns http gone' do
+            subject
+
+            expect(response)
+              .to have_http_status(410)
+          end
+        end
+
+        context 'when account is temporarily suspended' do
+          before { account.suspend! }
+
+          it 'returns http forbidden' do
+            subject
+
+            expect(response)
+              .to have_http_status(403)
+          end
+        end
+      end
+
+      context 'with signature' do
+        let(:remote_account) { Fabricate(:account, domain: 'example.com') }
+
+        context 'when getting a featured resource' do
+          it 'returns http success and correct media type and expected items' do
+            subject
+
+            expect(response)
+              .to have_http_status(200)
+              .and have_cacheable_headers
+
+            expect(response.media_type)
+              .to eq 'application/activity+json'
+
+            expect(response.parsed_body[:orderedItems])
+              .to be_an(Array)
+              .and have_attributes(size: 3)
+              .and include(ActivityPub::TagManager.instance.uri_for(private_pinned))
+              .and not_include(private_pinned.text)
+          end
+        end
+
+        context 'with authorized fetch mode' do
+          before { Setting.authorized_fetch = true }
+
+          context 'when signed request account is blocked' do
+            before { account.block!(remote_account) }
+
+            it 'returns http success and correct media type and cache headers and empty items' do
+              subject
+
+              expect(response)
+                .to have_http_status(200)
+              expect(response.media_type)
+                .to eq('application/activity+json')
+              expect(response.headers['Cache-Control'])
+                .to include('private')
+
+              expect(response.parsed_body)
+                .to include(
+                  orderedItems: be_an(Array).and(be_empty)
+                )
+            end
+          end
+
+          context 'when signed request account is domain blocked' do
+            before { account.block_domain!(remote_account.domain) }
+
+            it 'returns http success and correct media type and cache headers and empty items' do
+              subject
+
+              expect(response)
+                .to have_http_status(200)
+              expect(response.media_type)
+                .to eq('application/activity+json')
+              expect(response.headers['Cache-Control'])
+                .to include('private')
+
+              expect(response.parsed_body)
+                .to include(
+                  orderedItems: be_an(Array).and(be_empty)
+                )
+            end
+          end
+        end
+      end
+    end
+
+    context 'when id is not "featured"' do
+      let(:id) { 'hoge' }
+
+      it 'returns http not found' do
+        subject
+
+        expect(response)
+          .to have_http_status(404)
+      end
+    end
+  end
+end

spec/requests/activitypub/followers_synchronizations_spec.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'ActivityPub Follower Synchronizations' do
+  let!(:account) { Fabricate(:account) }
+  let!(:follower_example_com_user_a) { Fabricate(:account, domain: 'example.com', uri: 'https://example.com/users/a') }
+  let!(:follower_example_com_user_b) { Fabricate(:account, domain: 'example.com', uri: 'https://example.com/users/b') }
+  let!(:follower_foo_com_user_a) { Fabricate(:account, domain: 'foo.com', uri: 'https://foo.com/users/a') }
+  let!(:follower_example_com_instance_actor) { Fabricate(:account, username: 'instance-actor', domain: 'example.com', uri: 'https://example.com') }
+
+  before do
+    follower_example_com_user_a.follow!(account)
+    follower_example_com_user_b.follow!(account)
+    follower_foo_com_user_a.follow!(account)
+    follower_example_com_instance_actor.follow!(account)
+  end
+
+  describe 'GET #show' do
+    context 'without signature' do
+      subject { get account_followers_synchronization_path(account_username: account.username) }
+
+      it 'returns http not authorized' do
+        subject
+
+        expect(response)
+          .to have_http_status(401)
+      end
+    end
+
+    context 'with signature from example.com' do
+      subject { get account_followers_synchronization_path(account_username: account.username), headers: nil, sign_with: remote_account }
+
+      let(:remote_account) { Fabricate(:account, domain: 'example.com', uri: 'https://example.com/instance') }
+
+      it 'returns http success and cache control and activity json types and correct items' do
+        subject
+
+        expect(response)
+          .to have_http_status(200)
+        expect(response.headers['Cache-Control'])
+          .to eq 'max-age=0, private'
+        expect(response.media_type)
+          .to eq 'application/activity+json'
+
+        expect(response.parsed_body[:orderedItems])
+          .to be_an(Array)
+          .and contain_exactly(
+            follower_example_com_instance_actor.uri,
+            follower_example_com_user_a.uri,
+            follower_example_com_user_b.uri
+          )
+      end
+
+      context 'when account is permanently suspended' do
+        before do
+          account.suspend!
+          account.deletion_request.destroy
+        end
+
+        it 'returns http gone' do
+          subject
+
+          expect(response)
+            .to have_http_status(410)
+        end
+      end
+
+      context 'when account is temporarily suspended' do
+        before { account.suspend! }
+
+        it 'returns http forbidden' do
+          subject
+
+          expect(response)
+            .to have_http_status(403)
+        end
+      end
+    end
+  end
+end

spec/requests/activitypub/inboxes_spec.rb

@@ -0,0 +1,148 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'ActivityPub Inboxes' do
+  let(:remote_account) { nil }
+
+  describe 'POST #create' do
+    context 'with signature' do
+      let(:remote_account) { Fabricate(:account, domain: 'example.com', protocol: :activitypub) }
+
+      context 'without a named account' do
+        subject { post inbox_path, params: {}.to_json, sign_with: remote_account }
+
+        it 'returns http accepted' do
+          subject
+
+          expect(response)
+            .to have_http_status(202)
+        end
+      end
+
+      context 'with a specific account' do
+        subject { post account_inbox_path(account_username: account.username), params: {}.to_json, sign_with: remote_account }
+
+        let(:account) { Fabricate(:account) }
+
+        context 'when account is permanently suspended' do
+          before do
+            account.suspend!
+            account.deletion_request.destroy
+          end
+
+          it 'returns http gone' do
+            subject
+
+            expect(response)
+              .to have_http_status(410)
+          end
+        end
+
+        context 'when account is temporarily suspended' do
+          before { account.suspend! }
+
+          it 'returns http accepted' do
+            subject
+
+            expect(response)
+              .to have_http_status(202)
+          end
+        end
+      end
+    end
+
+    context 'with Collection-Synchronization header' do
+      subject { post inbox_path, params: {}.to_json, headers: { 'Collection-Synchronization' => synchronization_header }, sign_with: remote_account }
+
+      let(:remote_account) { Fabricate(:account, followers_url: 'https://example.com/followers', domain: 'example.com', uri: 'https://example.com/actor', protocol: :activitypub) }
+      let(:synchronization_collection) { remote_account.followers_url }
+      let(:synchronization_url) { 'https://example.com/followers-for-domain' }
+      let(:synchronization_hash) { 'somehash' }
+      let(:synchronization_header) { "collectionId=\"#{synchronization_collection}\", digest=\"#{synchronization_hash}\", url=\"#{synchronization_url}\"" }
+
+      before do
+        stub_follow_sync_worker
+        stub_followers_hash
+      end
+
+      context 'with mismatching target collection' do
+        let(:synchronization_collection) { 'https://example.com/followers2' }
+
+        it 'does not start a synchronization job' do
+          subject
+
+          expect(response)
+            .to have_http_status(202)
+          expect(ActivityPub::FollowersSynchronizationWorker)
+            .to_not have_received(:perform_async)
+        end
+      end
+
+      context 'with mismatching domain in partial collection attribute' do
+        let(:synchronization_url) { 'https://example.org/followers' }
+
+        it 'does not start a synchronization job' do
+          subject
+
+          expect(response)
+            .to have_http_status(202)
+          expect(ActivityPub::FollowersSynchronizationWorker)
+            .to_not have_received(:perform_async)
+        end
+      end
+
+      context 'with matching digest' do
+        it 'does not start a synchronization job' do
+          subject
+
+          expect(response)
+            .to have_http_status(202)
+          expect(ActivityPub::FollowersSynchronizationWorker)
+            .to_not have_received(:perform_async)
+        end
+      end
+
+      context 'with mismatching digest' do
+        let(:synchronization_hash) { 'wronghash' }
+
+        it 'starts a synchronization job' do
+          subject
+
+          expect(response)
+            .to have_http_status(202)
+          expect(ActivityPub::FollowersSynchronizationWorker)
+            .to have_received(:perform_async)
+        end
+      end
+
+      it 'returns http accepted' do
+        subject
+
+        expect(response)
+          .to have_http_status(202)
+      end
+
+      def stub_follow_sync_worker
+        allow(ActivityPub::FollowersSynchronizationWorker)
+          .to receive(:perform_async)
+          .and_return(nil)
+      end
+
+      def stub_followers_hash
+        Rails.cache.write("followers_hash:#{remote_account.id}:local", 'somehash') # Populate value to match request
+      end
+    end
+
+    context 'without signature' do
+      subject { post inbox_path, params: {}.to_json }
+
+      it 'returns http not authorized' do
+        subject
+
+        expect(response)
+          .to have_http_status(401)
+      end
+    end
+  end
+end

spec/requests/activitypub/outboxes_spec.rb

@@ -0,0 +1,221 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'ActivityPub Outboxes' do
+  let!(:account) { Fabricate(:account) }
+
+  before do
+    Fabricate(:status, account: account, visibility: :public)
+    Fabricate(:status, account: account, visibility: :unlisted)
+    Fabricate(:status, account: account, visibility: :private)
+    Fabricate(:status, account: account, visibility: :direct)
+    Fabricate(:status, account: account, visibility: :limited)
+  end
+
+  describe 'GET #show' do
+    context 'without signature' do
+      subject { get account_outbox_path(account_username: account.username, page: page) }
+
+      let(:remote_account) { nil }
+
+      context 'with page not requested' do
+        let(:page) { nil }
+
+        it 'returns http success and correct media type and headers and items count' do
+          subject
+
+          expect(response)
+            .to have_http_status(200)
+            .and have_cacheable_headers
+
+          expect(response.media_type)
+            .to eq 'application/activity+json'
+          expect(response.headers['Vary'])
+            .to be_nil
+          expect(response.parsed_body[:totalItems])
+            .to eq 4
+        end
+
+        context 'when account is permanently suspended' do
+          before do
+            account.suspend!
+            account.deletion_request.destroy
+          end
+
+          it 'returns http gone' do
+            subject
+
+            expect(response)
+              .to have_http_status(410)
+          end
+        end
+
+        context 'when account is temporarily suspended' do
+          before { account.suspend! }
+
+          it 'returns http forbidden' do
+            subject
+
+            expect(response)
+              .to have_http_status(403)
+          end
+        end
+      end
+
+      context 'with page requested' do
+        let(:page) { 'true' }
+
+        it 'returns http success and correct media type and vary header and items' do
+          subject
+
+          expect(response)
+            .to have_http_status(200)
+            .and have_cacheable_headers
+
+          expect(response.media_type)
+            .to eq 'application/activity+json'
+          expect(response.headers['Vary'])
+            .to include 'Signature'
+
+          expect(response.parsed_body)
+            .to include(
+              orderedItems: be_an(Array)
+              .and(have_attributes(size: 2))
+              .and(all(satisfy { |item| targets_public_collection?(item) }))
+            )
+        end
+
+        context 'when account is permanently suspended' do
+          before do
+            account.suspend!
+            account.deletion_request.destroy
+          end
+
+          it 'returns http gone' do
+            subject
+
+            expect(response)
+              .to have_http_status(410)
+          end
+        end
+
+        context 'when account is temporarily suspended' do
+          before { account.suspend! }
+
+          it 'returns http forbidden' do
+            subject
+
+            expect(response)
+              .to have_http_status(403)
+          end
+        end
+      end
+    end
+
+    context 'with signature' do
+      subject { get account_outbox_path(account_username: account.username, page: page), headers: nil, sign_with: remote_account }
+
+      let(:remote_account) { Fabricate(:account, domain: 'example.com') }
+      let(:page) { 'true' }
+
+      context 'when signed request account does not follow account' do
+        it 'returns http success and correct media type and headers and items' do
+          subject
+
+          expect(response)
+            .to have_http_status(200)
+          expect(response.media_type)
+            .to eq 'application/activity+json'
+          expect(response.headers['Cache-Control'])
+            .to eq 'private, no-store'
+
+          expect(response.parsed_body)
+            .to include(
+              orderedItems: be_an(Array)
+              .and(have_attributes(size: 2))
+              .and(all(satisfy { |item| targets_public_collection?(item) }))
+            )
+        end
+      end
+
+      context 'when signed request account follows account' do
+        before { remote_account.follow!(account) }
+
+        it 'returns http success and correct media type and headers and items' do
+          subject
+
+          expect(response)
+            .to have_http_status(200)
+          expect(response.media_type)
+            .to eq 'application/activity+json'
+          expect(response.headers['Cache-Control'])
+            .to eq 'private, no-store'
+
+          expect(response.parsed_body)
+            .to include(
+              orderedItems: be_an(Array)
+              .and(have_attributes(size: 3))
+              .and(all(satisfy { |item| targets_public_collection?(item) || targets_followers_collection?(item, account) }))
+            )
+        end
+      end
+
+      context 'when signed request account is blocked' do
+        before { account.block!(remote_account) }
+
+        it 'returns http success and correct media type and headers and items' do
+          subject
+
+          expect(response)
+            .to have_http_status(200)
+          expect(response.media_type)
+            .to eq 'application/activity+json'
+          expect(response.headers['Cache-Control'])
+            .to eq 'private, no-store'
+
+          expect(response.parsed_body)
+            .to include(
+              orderedItems: be_an(Array).and(be_empty)
+            )
+        end
+      end
+
+      context 'when signed request account is domain blocked' do
+        before { account.block_domain!(remote_account.domain) }
+
+        it 'returns http success and correct media type and headers and items' do
+          subject
+
+          expect(response)
+            .to have_http_status(200)
+          expect(response.media_type)
+            .to eq 'application/activity+json'
+          expect(response.headers['Cache-Control'])
+            .to eq 'private, no-store'
+
+          expect(response.parsed_body)
+            .to include(
+              orderedItems: be_an(Array).and(be_empty)
+            )
+        end
+      end
+    end
+  end
+
+  private
+
+  def ap_public_collection
+    ActivityPub::TagManager::COLLECTIONS[:public]
+  end
+
+  def targets_public_collection?(item)
+    item[:to].include?(ap_public_collection) || item[:cc].include?(ap_public_collection)
+  end
+
+  def targets_followers_collection?(item, account)
+    item[:to].include?(
+      account_followers_url(account, ActionMailer::Base.default_url_options)
+    )
+  end
+end

spec/requests/activitypub/replies_spec.rb

@@ -0,0 +1,272 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'ActivityPub Replies' do
+  let(:status) { Fabricate(:status, visibility: parent_visibility) }
+  let(:remote_account) { Fabricate(:account, domain: 'foobar.com') }
+  let(:remote_reply_id) { 'https://foobar.com/statuses/1234' }
+  let(:remote_querier) { nil }
+
+  shared_examples 'common behavior' do
+    context 'when status is private' do
+      let(:parent_visibility) { :private }
+
+      it 'returns http not found' do
+        subject
+
+        expect(response)
+          .to have_http_status(404)
+      end
+    end
+
+    context 'when status is direct' do
+      let(:parent_visibility) { :direct }
+
+      it 'returns http not found' do
+        subject
+
+        expect(response)
+          .to have_http_status(404)
+      end
+    end
+  end
+
+  shared_examples 'disallowed access' do
+    context 'when status is public' do
+      let(:parent_visibility) { :public }
+
+      it 'returns http not found' do
+        subject
+
+        expect(response)
+          .to have_http_status(404)
+      end
+    end
+
+    it_behaves_like 'common behavior'
+  end
+
+  shared_examples 'allowed access' do
+    context 'when account is permanently suspended' do
+      let(:parent_visibility) { :public }
+
+      before do
+        status.account.suspend!
+        status.account.deletion_request.destroy
+      end
+
+      it 'returns http gone' do
+        subject
+
+        expect(response)
+          .to have_http_status(410)
+      end
+    end
+
+    context 'when account is temporarily suspended' do
+      let(:parent_visibility) { :public }
+
+      before { status.account.suspend! }
+
+      it 'returns http forbidden' do
+        subject
+
+        expect(response)
+          .to have_http_status(403)
+      end
+    end
+
+    context 'when status is public' do
+      let(:parent_visibility) { :public }
+
+      it 'returns http success and correct media type' do
+        subject
+
+        expect(response)
+          .to have_http_status(200)
+          .and have_cacheable_headers
+
+        expect(response.media_type)
+          .to eq 'application/activity+json'
+      end
+
+      context 'without `only_other_accounts` param' do
+        it "returns items with thread author's replies" do
+          subject
+
+          expect(response.parsed_body)
+            .to include(
+              first: be_a(Hash).and(
+                include(
+                  items: be_an(Array)
+                  .and(have_attributes(size: 1))
+                  .and(all(satisfy { |item| targets_public_collection?(item) }))
+                )
+              )
+            )
+        end
+
+        context 'when there are few self-replies' do
+          it 'points next to replies from other people' do
+            subject
+
+            expect(response.parsed_body)
+              .to include(
+                first: be_a(Hash).and(
+                  include(
+                    next: satisfy { |value| (parsed_uri_query_values(value) & %w(only_other_accounts=true page=true)).any? }
+                  )
+                )
+              )
+          end
+        end
+
+        context 'when there are many self-replies' do
+          before do
+            10.times { Fabricate(:status, account: status.account, thread: status, visibility: :public) }
+          end
+
+          it 'points next to other self-replies' do
+            subject
+
+            expect(response.parsed_body)
+              .to include(
+                first: be_a(Hash).and(
+                  include(
+                    next: satisfy { |value| (parsed_uri_query_values(value) & %w(only_other_accounts=false page=true)).any? }
+                  )
+                )
+              )
+          end
+        end
+      end
+
+      context 'with `only_other_accounts` param' do
+        let(:only_other_accounts) { 'true' }
+
+        it 'returns items with other public or unlisted replies and correctly inlines replies and uses IDs' do
+          subject
+
+          expect(response.parsed_body)
+            .to include(
+              first: be_a(Hash).and(
+                include(items: be_an(Array).and(have_attributes(size: 3)))
+              )
+            )
+
+          # Only inline replies that are local and public, or unlisted
+          expect(inlined_replies)
+            .to all(satisfy { |item| targets_public_collection?(item) })
+            .and all(satisfy { |item| ActivityPub::TagManager.instance.local_uri?(item[:id]) })
+
+          # Use ids for remote replies
+          expect(remote_replies)
+            .to all(satisfy { |item| item.is_a?(String) && !ActivityPub::TagManager.instance.local_uri?(item) })
+        end
+
+        context 'when there are few replies' do
+          it 'does not have a next page' do
+            subject
+
+            expect(response.parsed_body)
+              .to include(
+                first: be_a(Hash).and(not_include(next: be_present))
+              )
+          end
+        end
+
+        context 'when there are many replies' do
+          before do
+            10.times { Fabricate(:status, thread: status, visibility: :public) }
+          end
+
+          it 'points next to other replies' do
+            subject
+
+            expect(response.parsed_body)
+              .to include(
+                first: be_a(Hash).and(
+                  include(
+                    next: satisfy { |value| (parsed_uri_query_values(value) & %w(only_other_accounts=true page=true)).any? }
+                  )
+                )
+              )
+          end
+        end
+      end
+    end
+
+    it_behaves_like 'common behavior'
+  end
+
+  before do
+    stub_const 'ActivityPub::RepliesController::DESCENDANTS_LIMIT', 5
+
+    Fabricate.times(2, :status, thread: status, visibility: :public)
+    Fabricate(:status, thread: status, visibility: :private)
+    Fabricate(:status, account: status.account, thread: status, visibility: :public)
+    Fabricate(:status, account: status.account, thread: status, visibility: :private)
+
+    Fabricate(:status, account: remote_account, thread: status, visibility: :public, uri: remote_reply_id)
+  end
+
+  describe 'GET #index' do
+    let(:only_other_accounts) { nil }
+
+    context 'with no signature' do
+      subject { get account_status_replies_path(account_username: status.account.username, status_id: status.id, only_other_accounts: only_other_accounts) }
+
+      it_behaves_like 'allowed access'
+    end
+
+    context 'with signature' do
+      subject { get account_status_replies_path(account_username: status.account.username, status_id: status.id, only_other_accounts: only_other_accounts), headers: nil, sign_with: remote_querier }
+
+      let(:remote_querier) { Fabricate(:account, domain: 'example.com') }
+
+      it_behaves_like 'allowed access'
+
+      context 'when signed request account is blocked' do
+        before { status.account.block!(remote_querier) }
+
+        it_behaves_like 'disallowed access'
+      end
+
+      context 'when signed request account is domain blocked' do
+        before { status.account.block_domain!(remote_querier.domain) }
+
+        it_behaves_like 'disallowed access'
+      end
+    end
+  end
+
+  private
+
+  def inlined_replies
+    response
+      .parsed_body[:first][:items]
+      .select { |x| x.is_a?(Hash) }
+  end
+
+  def remote_replies
+    response
+      .parsed_body[:first][:items]
+      .reject { |x| x.is_a?(Hash) }
+  end
+
+  def parsed_uri_query_values(uri)
+    Addressable::URI
+      .parse(uri)
+      .query
+      .split('&')
+  end
+
+  def ap_public_collection
+    ActivityPub::TagManager::COLLECTIONS[:public]
+  end
+
+  def targets_public_collection?(item)
+    item[:to].include?(ap_public_collection) || item[:cc].include?(ap_public_collection)
+  end
+end

spec/requests/api/v1/accounts_spec.rb

@@ -74,12 +74,45 @@ RSpec.describe '/api/v1/accounts' do
 
   describe 'POST /api/v1/accounts' do
     subject do
-      post '/api/v1/accounts', headers: headers, params: { username: 'test', password: '12345678', email: 'hello@world.tld', agreement: agreement }
+      post '/api/v1/accounts', headers: headers, params: { username: 'test', password: '12345678', email: 'hello@world.tld', agreement: agreement, date_of_birth: date_of_birth }
     end
 
     let(:client_app) { Fabricate(:application) }
     let(:token) { Doorkeeper::AccessToken.find_or_create_for(application: client_app, resource_owner: nil, scopes: 'read write', use_refresh_token: false) }
     let(:agreement) { nil }
+    let(:date_of_birth) { nil }
+
+    context 'when age verification is enabled' do
+      before do
+        Setting.min_age = 16
+      end
+
+      let(:agreement) { 'true' }
+
+      context 'when date of birth is below age limit' do
+        let(:date_of_birth) { 13.years.ago.strftime('%d.%m.%Y') }
+
+        it 'returns http unprocessable entity' do
+          subject
+
+          expect(response).to have_http_status(422)
+          expect(response.content_type)
+            .to start_with('application/json')
+        end
+      end
+
+      context 'when date of birth is over age limit' do
+        let(:date_of_birth) { 17.years.ago.strftime('%d.%m.%Y') }
+
+        it 'creates a user', :aggregate_failures do
+          subject
+
+          expect(response).to have_http_status(200)
+          expect(response.content_type)
+            .to start_with('application/json')
+        end
+      end
+    end
 
     context 'when given truthy agreement' do
       let(:agreement) { 'true' }

spec/requests/api/v1/trends/tags_spec.rb

@@ -15,6 +15,8 @@ RSpec.describe 'API V1 Trends Tags' do
           .and not_have_http_link_header
         expect(response.content_type)
           .to start_with('application/json')
+        expect(response.headers['Deprecation'])
+          .to be_nil
       end
     end
 
@@ -31,6 +33,8 @@ RSpec.describe 'API V1 Trends Tags' do
           .and have_http_link_header(api_v1_trends_tags_url(offset: 2)).for(rel: 'next')
         expect(response.content_type)
           .to start_with('application/json')
+        expect(response.headers['Deprecation'])
+          .to be_nil
       end
 
       def prepare_trends

spec/requests/api/v1/trends_spec.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'deprecated API V1 Trends Tags' do
+  describe 'GET /api/v1/trends' do
+    context 'when trends are disabled' do
+      before { Setting.trends = false }
+
+      it 'returns http success' do
+        get '/api/v1/trends'
+
+        expect(response)
+          .to have_http_status(200)
+          .and not_have_http_link_header
+        expect(response.content_type)
+          .to start_with('application/json')
+        expect(response.headers['Deprecation'])
+          .to start_with '@'
+      end
+    end
+
+    context 'when trends are enabled' do
+      before { Setting.trends = true }
+
+      it 'returns http success' do
+        prepare_trends
+        stub_const('Api::V1::Trends::TagsController::DEFAULT_TAGS_LIMIT', 2)
+        get '/api/v1/trends'
+
+        expect(response)
+          .to have_http_status(200)
+          .and have_http_link_header(api_v1_trends_tags_url(offset: 2)).for(rel: 'next')
+        expect(response.content_type)
+          .to start_with('application/json')
+        expect(response.headers['Deprecation'])
+          .to start_with '@'
+      end
+
+      def prepare_trends
+        Fabricate.times(3, :tag, trendable: true).each do |tag|
+          2.times { |i| Trends.tags.add(tag, i) }
+        end
+        Trends::Tags.new(threshold: 1).refresh
+      end
+    end
+  end
+end

spec/requests/api/v2/notifications_spec.rb

@@ -158,19 +158,18 @@ RSpec.describe 'Notifications' do
           expect(response).to have_http_status(200)
           expect(response.content_type)
             .to start_with('application/json')
-          expect(response.parsed_body[:notification_groups]).to contain_exactly(
-            a_hash_including(
-              type: 'favourite',
-              sample_account_ids: have_attributes(size: 5),
-              page_min_id: notification_ids.first.to_s,
-              page_max_id: notification_ids.last.to_s
-            )
-          )
+          expect(response.parsed_body[:notification_groups].size)
+            .to eq(1)
+          expect(response.parsed_body.dig(:notification_groups, 0))
+            .to include(type: 'favourite')
+            .and(include(sample_account_ids: have_attributes(size: 5)))
+            .and(include(page_max_id: notification_ids.last.to_s))
+            .and(include(page_min_id: notification_ids.first.to_s))
         end
       end
 
       context 'with min_id param' do
-        let(:params) { { min_id: user.account.notifications.reload.first.id - 1 } }
+        let(:params) { { min_id: user.account.notifications.order(id: :asc).first.id - 1 } }
 
         it 'returns a notification group covering all notifications' do
           subject
@@ -180,14 +179,13 @@ RSpec.describe 'Notifications' do
           expect(response).to have_http_status(200)
           expect(response.content_type)
             .to start_with('application/json')
-          expect(response.parsed_body[:notification_groups]).to contain_exactly(
-            a_hash_including(
-              type: 'favourite',
-              sample_account_ids: have_attributes(size: 5),
-              page_min_id: notification_ids.first.to_s,
-              page_max_id: notification_ids.last.to_s
-            )
-          )
+          expect(response.parsed_body[:notification_groups].size)
+            .to eq(1)
+          expect(response.parsed_body.dig(:notification_groups, 0))
+            .to include(type: 'favourite')
+            .and(include(sample_account_ids: have_attributes(size: 5)))
+            .and(include(page_max_id: notification_ids.last.to_s))
+            .and(include(page_min_id: notification_ids.first.to_s))
         end
       end
     end

spec/requests/disputes/strikes_spec.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Disputes Strikes' do
+  before { sign_in current_user }
+
+  describe 'GET /disputes/strikes/:id' do
+    let(:current_user) { Fabricate(:user) }
+
+    context 'when meant for a different user' do
+      let(:strike) { Fabricate(:account_warning) }
+
+      it 'returns http forbidden' do
+        get disputes_strike_path(strike)
+
+        expect(response)
+          .to have_http_status(403)
+      end
+    end
+  end
+end

spec/requests/filters/statuses_spec.rb

@@ -16,4 +16,30 @@ RSpec.describe 'Filters Statuses' do
         .to redirect_to(edit_filter_path(filter))
     end
   end
+
+  describe 'GET /filters/:filter_id/statuses' do
+    let(:filter) { Fabricate(:custom_filter) }
+
+    context 'with signed out user' do
+      it 'redirects' do
+        get filter_statuses_path(filter)
+
+        expect(response)
+          .to be_redirect
+      end
+    end
+
+    context 'with a signed in user' do
+      context 'with another user signed in' do
+        before { sign_in(Fabricate(:user)) }
+
+        it 'returns http not found' do
+          get filter_statuses_path(filter)
+
+          expect(response)
+            .to have_http_status(404)
+        end
+      end
+    end
+  end
 end

spec/requests/intents_spec.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Intents' do
+  let(:user) { Fabricate(:user) }
+
+  before { sign_in user, scope: :user }
+
+  describe 'GET /intent' do
+    subject { response }
+
+    before { get intent_path(uri: uri) }
+
+    context 'when schema is web+mastodon' do
+      context 'when host is follow' do
+        let(:uri) { 'web+mastodon://follow?uri=test' }
+
+        it { is_expected.to redirect_to authorize_interaction_path(uri: 'test') }
+      end
+
+      context 'when host is share' do
+        let(:uri) { 'web+mastodon://share?text=test' }
+
+        it { is_expected.to redirect_to share_path(text: 'test') }
+      end
+
+      context 'when host is none of the above' do
+        let(:uri) { 'web+mastodon://test' }
+
+        it { is_expected.to have_http_status 404 }
+      end
+    end
+
+    context 'when schema is not web+mastodon' do
+      let(:uri) { 'api+mastodon://test.com' }
+
+      it { is_expected.to have_http_status 404 }
+    end
+
+    context 'when uri param is blank' do
+      let(:uri) { '' }
+
+      it { is_expected.to have_http_status 404 }
+    end
+
+    context 'when uri is invalid' do
+      let(:uri) { 'invalid uri://test.com' }
+
+      it { is_expected.to have_http_status 404 }
+    end
+  end
+end

spec/requests/oauth/token_spec.rb

@@ -2,7 +2,7 @@
 
 require 'rails_helper'
 
-RSpec.describe 'Obtaining OAuth Tokens' do
+RSpec.describe 'Managing OAuth Tokens' do
   describe 'POST /oauth/token' do
     subject do
       post '/oauth/token', params: params
@@ -104,4 +104,23 @@ RSpec.describe 'Obtaining OAuth Tokens' do
       end
     end
   end
+
+  describe 'POST /oauth/revoke' do
+    subject { post '/oauth/revoke', params: { client_id: application.uid, token: access_token.token } }
+
+    let!(:user) { Fabricate(:user) }
+    let!(:application) { Fabricate(:application, confidential: false) }
+    let!(:access_token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, application: application) }
+    let!(:web_push_subscription) { Fabricate(:web_push_subscription, user: user, access_token: access_token) }
+
+    it 'revokes the token and removes subscriptions' do
+      expect { subject }
+        .to change { access_token.reload.revoked_at }.from(nil).to(be_present)
+
+      expect(Web::PushSubscription.where(access_token: access_token).count)
+        .to eq(0)
+      expect { web_push_subscription.reload }
+        .to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
 end

spec/requests/settings/deletes_spec.rb

@@ -4,13 +4,65 @@ require 'rails_helper'
 
 RSpec.describe 'Settings Deletes' do
   describe 'DELETE /settings/delete' do
-    before { sign_in Fabricate(:user) }
+    context 'when signed in' do
+      before { sign_in(user) }
 
-    it 'gracefully handles invalid nested params' do
-      delete settings_delete_path(form_delete_confirmation: 'invalid')
+      let(:user) { Fabricate(:user) }
 
-      expect(response)
-        .to have_http_status(400)
+      it 'gracefully handles invalid nested params' do
+        delete settings_delete_path(form_delete_confirmation: 'invalid')
+
+        expect(response)
+          .to have_http_status(400)
+      end
+
+      context 'when suspended' do
+        let(:user) { Fabricate(:user, account_attributes: { suspended_at: Time.now.utc }) }
+
+        it 'returns http forbidden' do
+          delete settings_delete_path
+
+          expect(response)
+            .to have_http_status(403)
+        end
+      end
+    end
+
+    context 'when not signed in' do
+      it 'redirects to sign in' do
+        delete settings_delete_path
+
+        expect(response)
+          .to redirect_to(new_user_session_path)
+      end
+    end
+  end
+
+  describe 'GET /settings/delete' do
+    context 'when signed in' do
+      before { sign_in(user) }
+
+      context 'when suspended' do
+        let(:user) { Fabricate(:user, account_attributes: { suspended_at: Time.now.utc }) }
+
+        it 'returns http forbidden with private cache control headers' do
+          get settings_delete_path
+
+          expect(response)
+            .to have_http_status(403)
+          expect(response.headers['Cache-Control'])
+            .to include('private, no-store')
+        end
+      end
+    end
+
+    context 'when not signed in' do
+      it 'redirects to sign in' do
+        get settings_delete_path
+
+        expect(response)
+          .to redirect_to(new_user_session_path)
+      end
     end
   end
 end