Merge remote-tracking branch 'parent/main' into upstream-20241101

spec/requests/api/v1/trends/statuses_spec.rb

@@ -39,6 +39,42 @@ RSpec.describe 'API V1 Trends Statuses' do
         end
         Trends::Statuses.new(threshold: 1, decay_threshold: -1).refresh
       end
+
+      context 'with a comically inflated external interactions count' do
+        def prepare_fake_trends
+          fake_remote_account = Fabricate(:account, domain: 'other.com')
+          fake_status = Fabricate(:status, account: fake_remote_account, text: 'I am a big faker', trendable: true, language: 'en')
+          fake_status.status_stat.tap do |status_stat|
+            status_stat.reblogs_count = 0
+            status_stat.favourites_count = 0
+            status_stat.untrusted_reblogs_count = 1_000_000_000
+            status_stat.untrusted_favourites_count = 1_000_000_000
+            status_stat.save
+          end
+          real_remote_account = Fabricate(:account, domain: 'other.com')
+          real_status = Fabricate(:status, account: real_remote_account, text: 'I make real friends online', trendable: true, language: 'en')
+          real_status.status_stat.tap do |status_stat|
+            status_stat.reblogs_count = 10
+            status_stat.favourites_count = 10
+            status_stat.untrusted_reblogs_count = 10
+            status_stat.untrusted_favourites_count = 10
+            status_stat.save
+          end
+          Trends.statuses.add(fake_status, 100)
+          Trends.statuses.add(real_status, 101)
+          Trends::Statuses.new(threshold: 1, decay_threshold: 1).refresh
+        end
+
+        it 'ignores the feeble attempts at deception' do
+          prepare_fake_trends
+          stub_const('Api::BaseController::DEFAULT_STATUSES_LIMIT', 10)
+          get '/api/v1/trends/statuses'
+
+          expect(response).to have_http_status(200)
+          expect(response.parsed_body.length).to eq(1)
+          expect(response.parsed_body[0]['content']).to eq('I make real friends online')
+        end
+      end
     end
   end
 end

spec/requests/api/v2/media_spec.rb

@@ -29,6 +29,22 @@ RSpec.describe 'Media API', :attachment_processing do
       end
     end
 
+    context 'when media description is too long' do
+      let(:params) do
+        {
+          file: fixture_file_upload('attachment-jpg.123456_abcd', 'image/jpeg'),
+          description: 'aa' * MediaAttachment::MAX_DESCRIPTION_LENGTH,
+        }
+      end
+
+      it 'returns http error' do
+        post '/api/v2/media', headers: headers, params: params
+
+        expect(response).to have_http_status(422)
+        expect(response.body).to include 'Description is too long'
+      end
+    end
+
     context 'when large format media attachment has not been processed' do
       let(:params) { { file: fixture_file_upload('attachment.webm', 'video/webm') } }
 

spec/requests/oauth/userinfo_spec.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Oauth Userinfo Endpoint' do
+  include RoutingHelper
+
+  let(:user)     { Fabricate(:user) }
+  let(:account)  { user.account }
+  let(:token)    { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
+  let(:scopes)   { 'profile' }
+  let(:headers)  { { 'Authorization' => "Bearer #{token.token}" } }
+
+  shared_examples 'returns successfully' do
+    it 'returns http success' do
+      subject
+
+      expect(response).to have_http_status(:success)
+      expect(response.content_type).to start_with('application/json')
+      expect(response.parsed_body).to include({
+        iss: root_url,
+        sub: account_url(account),
+        name: account.display_name,
+        preferred_username: account.username,
+        profile: short_account_url(account),
+        picture: full_asset_url(account.avatar_original_url),
+      })
+    end
+  end
+
+  describe 'GET /oauth/userinfo' do
+    subject do
+      get '/oauth/userinfo', headers: headers
+    end
+
+    it_behaves_like 'forbidden for wrong scope', 'read:accounts'
+    it_behaves_like 'returns successfully'
+  end
+
+  # As this is borrowed from OpenID, the specification says we must also support
+  # POST for the userinfo endpoint:
+  # https://openid.net/specs/openid-connect-core-1_0.html#UserInfo
+  describe 'POST /oauth/userinfo' do
+    subject do
+      post '/oauth/userinfo', headers: headers
+    end
+
+    it_behaves_like 'forbidden for wrong scope', 'read:accounts'
+    it_behaves_like 'returns successfully'
+  end
+end

spec/requests/well_known/oauth_metadata_spec.rb

@@ -3,12 +3,6 @@
 require 'rails_helper'
 
 RSpec.describe 'The /.well-known/oauth-authorization-server request' do
-  let(:protocol) { ENV.fetch('LOCAL_HTTPS', true) ? :https : :http }
-
-  before do
-    host! Rails.configuration.x.local_domain
-  end
-
   it 'returns http success with valid JSON response' do
     get '/.well-known/oauth-authorization-server'
 
@@ -22,11 +16,12 @@ RSpec.describe 'The /.well-known/oauth-authorization-server request' do
     grant_types_supported << 'refresh_token' if Doorkeeper.configuration.refresh_token_enabled?
 
     expect(response.parsed_body).to include(
-      issuer: root_url(protocol: protocol),
+      issuer: root_url,
       service_documentation: 'https://docs.joinmastodon.org/',
-      authorization_endpoint: oauth_authorization_url(protocol: protocol),
-      token_endpoint: oauth_token_url(protocol: protocol),
-      revocation_endpoint: oauth_revoke_url(protocol: protocol),
+      authorization_endpoint: oauth_authorization_url,
+      token_endpoint: oauth_token_url,
+      userinfo_endpoint: oauth_userinfo_url,
+      revocation_endpoint: oauth_revoke_url,
       scopes_supported: Doorkeeper.configuration.scopes.map(&:to_s),
       response_types_supported: Doorkeeper.configuration.authorization_response_types,
       response_modes_supported: Doorkeeper.configuration.authorization_response_flows.flat_map(&:response_mode_matches).uniq,
@@ -34,7 +29,7 @@ RSpec.describe 'The /.well-known/oauth-authorization-server request' do
       grant_types_supported: grant_types_supported,
       code_challenge_methods_supported: ['S256'],
       # non-standard extension:
-      app_registration_endpoint: api_v1_apps_url(protocol: protocol)
+      app_registration_endpoint: api_v1_apps_url
     )
   end
 end