Merge remote-tracking branch 'parent/main' into upstream-20231116

spec/requests/api/v1/accounts/relationships_spec.rb

@@ -27,12 +27,16 @@ describe 'GET /api/v1/accounts/relationships' do
     it 'returns JSON with correct data', :aggregate_failures do
       subject
 
-      json = body_as_json
-
-      expect(response).to have_http_status(200)
-      expect(json).to be_a Enumerable
-      expect(json.first[:following]).to be true
-      expect(json.first[:followed_by]).to be false
+      expect(response)
+        .to have_http_status(200)
+      expect(body_as_json)
+        .to be_an(Enumerable)
+        .and have_attributes(
+          first: include(
+            following: true,
+            followed_by: false
+          )
+        )
     end
   end
 
@@ -40,18 +44,19 @@ describe 'GET /api/v1/accounts/relationships' do
     let(:params) { { id: [simon.id, lewis.id, bob.id] } }
 
     context 'when there is returned JSON data' do
-      let(:json) { body_as_json }
-
       context 'with default parameters' do
         it 'returns an enumerable json with correct elements, excluding suspended accounts', :aggregate_failures do
           subject
 
-          expect(response).to have_http_status(200)
-          expect(json).to be_a Enumerable
-          expect(json.size).to eq 2
-
-          expect_simon_item_one
-          expect_lewis_item_two
+          expect(response)
+            .to have_http_status(200)
+          expect(body_as_json)
+            .to be_an(Enumerable)
+            .and have_attributes(
+              size: 2,
+              first: include(simon_item),
+              second: include(lewis_item)
+            )
         end
       end
 
@@ -61,62 +66,75 @@ describe 'GET /api/v1/accounts/relationships' do
         it 'returns an enumerable json with correct elements, including suspended accounts', :aggregate_failures do
           subject
 
-          expect(response).to have_http_status(200)
-          expect(json).to be_a Enumerable
-          expect(json.size).to eq 3
-
-          expect_simon_item_one
-          expect_lewis_item_two
-          expect_bob_item_three
+          expect(response)
+            .to have_http_status(200)
+          expect(body_as_json)
+            .to be_an(Enumerable)
+            .and have_attributes(
+              size: 3,
+              first: include(simon_item),
+              second: include(lewis_item),
+              third: include(bob_item)
+            )
         end
       end
 
-      def expect_simon_item_one
-        expect(json.first[:id]).to eq simon.id.to_s
-        expect(json.first[:following]).to be true
-        expect(json.first[:showing_reblogs]).to be true
-        expect(json.first[:followed_by]).to be false
-        expect(json.first[:muting]).to be false
-        expect(json.first[:requested]).to be false
-        expect(json.first[:domain_blocking]).to be false
+      def simon_item
+        {
+          id: simon.id.to_s,
+          following: true,
+          showing_reblogs: true,
+          followed_by: false,
+          muting: false,
+          requested: false,
+          domain_blocking: false,
+        }
       end
 
-      def expect_lewis_item_two
-        expect(json.second[:id]).to eq lewis.id.to_s
-        expect(json.second[:following]).to be false
-        expect(json.second[:showing_reblogs]).to be false
-        expect(json.second[:followed_by]).to be true
-        expect(json.second[:muting]).to be false
-        expect(json.second[:requested]).to be false
-        expect(json.second[:domain_blocking]).to be false
+      def lewis_item
+        {
+          id: lewis.id.to_s,
+          following: false,
+          showing_reblogs: false,
+          followed_by: true,
+          muting: false,
+          requested: false,
+          domain_blocking: false,
+
+        }
       end
 
-      def expect_bob_item_three
-        expect(json.third[:id]).to eq bob.id.to_s
-        expect(json.third[:following]).to be false
-        expect(json.third[:showing_reblogs]).to be false
-        expect(json.third[:followed_by]).to be false
-        expect(json.third[:muting]).to be false
-        expect(json.third[:requested]).to be false
-        expect(json.third[:domain_blocking]).to be false
+      def bob_item
+        {
+          id: bob.id.to_s,
+          following: false,
+          showing_reblogs: false,
+          followed_by: false,
+          muting: false,
+          requested: false,
+          domain_blocking: false,
+
+        }
       end
     end
 
     it 'returns JSON with correct data on previously cached requests' do
       # Initial request including multiple accounts in params
       get '/api/v1/accounts/relationships', headers: headers, params: { id: [simon.id, lewis.id] }
-      expect(body_as_json.size).to eq(2)
+      expect(body_as_json)
+        .to have_attributes(size: 2)
 
       # Subsequent request with different id, should override cache from first request
       get '/api/v1/accounts/relationships', headers: headers, params: { id: [simon.id] }
 
-      expect(response).to have_http_status(200)
+      expect(response)
+        .to have_http_status(200)
 
       expect(body_as_json)
         .to be_an(Enumerable)
         .and have_attributes(
           size: 1,
-          first: hash_including(
+          first: include(
             following: true,
             showing_reblogs: true
           )
@@ -129,13 +147,17 @@ describe 'GET /api/v1/accounts/relationships' do
 
       get '/api/v1/accounts/relationships', headers: headers, params: { id: [simon.id] }
 
-      expect(response).to have_http_status(200)
+      expect(response)
+        .to have_http_status(200)
 
-      json = body_as_json
-
-      expect(json).to be_a Enumerable
-      expect(json.first[:following]).to be false
-      expect(json.first[:showing_reblogs]).to be false
+      expect(body_as_json)
+        .to be_an(Enumerable)
+        .and have_attributes(
+          first: include(
+            following: false,
+            showing_reblogs: false
+          )
+        )
     end
   end
 end

spec/requests/host_meta_request_spec.rb

@@ -1,14 +0,0 @@
-# frozen_string_literal: true
-
-require 'rails_helper'
-
-describe 'The host_meta route' do
-  describe 'requested without accepts headers' do
-    it 'returns an xml response' do
-      get host_meta_url
-
-      expect(response).to have_http_status(200)
-      expect(response.media_type).to eq 'application/xrd+xml'
-    end
-  end
-end

spec/requests/webfinger_request_spec.rb

@@ -1,33 +0,0 @@
-# frozen_string_literal: true
-
-require 'rails_helper'
-
-describe 'The webfinger route' do
-  let(:alice) { Fabricate(:account, username: 'alice') }
-
-  describe 'requested with standard accepts headers' do
-    it 'returns a json response' do
-      get webfinger_url(resource: alice.to_webfinger_s)
-
-      expect(response).to have_http_status(200)
-      expect(response.media_type).to eq 'application/jrd+json'
-    end
-  end
-
-  describe 'asking for json format' do
-    it 'returns a json response for json format' do
-      get webfinger_url(resource: alice.to_webfinger_s, format: :json)
-
-      expect(response).to have_http_status(200)
-      expect(response.media_type).to eq 'application/jrd+json'
-    end
-
-    it 'returns a json response for json accept header' do
-      headers = { 'HTTP_ACCEPT' => 'application/jrd+json' }
-      get webfinger_url(resource: alice.to_webfinger_s), headers: headers
-
-      expect(response).to have_http_status(200)
-      expect(response.media_type).to eq 'application/jrd+json'
-    end
-  end
-end

spec/requests/well_known/change_password_spec.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe 'The /.well-known/change-password request' do
+  it 'redirects to the change password page' do
+    get '/.well-known/change-password'
+
+    expect(response).to redirect_to '/auth/edit'
+  end
+end

spec/requests/well_known/host_meta_spec.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe 'The /.well-known/host-meta request' do
+  it 'returns http success with valid XML response' do
+    get '/.well-known/host-meta'
+
+    expect(response)
+      .to have_http_status(200)
+      .and have_attributes(
+        media_type: 'application/xrd+xml',
+        body: host_meta_xml_template
+      )
+  end
+
+  private
+
+  def host_meta_xml_template
+    <<~XML
+      <?xml version="1.0" encoding="UTF-8"?>
+      <XRD xmlns="http://docs.oasis-open.org/ns/xri/xrd-1.0">
+        <Link rel="lrdd" template="https://cb6e6126.ngrok.io/.well-known/webfinger?resource={uri}"/>
+      </XRD>
+    XML
+  end
+end

spec/requests/well_known/node_info_spec.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe 'The well-known node-info endpoints' do
+  describe 'The /.well-known/node-info endpoint' do
+    it 'returns JSON document pointing to node info' do
+      get '/.well-known/nodeinfo'
+
+      expect(response)
+        .to have_http_status(200)
+        .and have_attributes(
+          media_type: 'application/json'
+        )
+
+      expect(body_as_json).to include(
+        links: be_an(Array).and(
+          contain_exactly(
+            include(
+              rel: 'http://nodeinfo.diaspora.software/ns/schema/2.0',
+              href: include('nodeinfo/2.0')
+            )
+          )
+        )
+      )
+    end
+  end
+
+  describe 'The /nodeinfo/2.0 endpoint' do
+    it 'returns JSON document with node info properties' do
+      get '/nodeinfo/2.0'
+
+      expect(response)
+        .to have_http_status(200)
+        .and have_attributes(
+          media_type: 'application/json'
+        )
+
+      expect(non_matching_hash)
+        .to_not match_json_schema('nodeinfo_2.0')
+
+      expect(body_as_json)
+        .to match_json_schema('nodeinfo_2.0')
+        .and include(
+          version: '2.0',
+          usage: be_a(Hash),
+          software: be_a(Hash),
+          protocols: be_a(Array)
+        )
+    end
+
+    private
+
+    def non_matching_hash
+      { 'foo' => 0 }
+    end
+  end
+end

spec/requests/well_known/webfinger_spec.rb

@@ -0,0 +1,255 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe 'The /.well-known/webfinger endpoint' do
+  subject(:perform_request!) { get webfinger_url(resource: resource) }
+
+  let(:alternate_domains) { [] }
+  let(:alice) { Fabricate(:account, username: 'alice') }
+  let(:resource) { nil }
+
+  around do |example|
+    tmp = Rails.configuration.x.alternate_domains
+    Rails.configuration.x.alternate_domains = alternate_domains
+    example.run
+    Rails.configuration.x.alternate_domains = tmp
+  end
+
+  shared_examples 'a successful response' do
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'sets only a Vary Origin header' do
+      expect(response.headers['Vary']).to eq('Origin')
+    end
+
+    it 'returns application/jrd+json' do
+      expect(response.media_type).to eq 'application/jrd+json'
+    end
+
+    it 'returns links for the account' do
+      json = body_as_json
+      expect(json[:subject]).to eq 'acct:alice@cb6e6126.ngrok.io'
+      expect(json[:aliases]).to include('https://cb6e6126.ngrok.io/@alice', 'https://cb6e6126.ngrok.io/users/alice')
+    end
+  end
+
+  context 'when an account exists' do
+    let(:resource) { alice.to_webfinger_s }
+
+    before do
+      perform_request!
+    end
+
+    it_behaves_like 'a successful response'
+  end
+
+  context 'when an account is temporarily suspended' do
+    let(:resource) { alice.to_webfinger_s }
+
+    before do
+      alice.suspend!
+      perform_request!
+    end
+
+    it_behaves_like 'a successful response'
+  end
+
+  context 'when an account is permanently suspended or deleted' do
+    let(:resource) { alice.to_webfinger_s }
+
+    before do
+      alice.suspend!
+      alice.deletion_request.destroy
+      perform_request!
+    end
+
+    it 'returns http gone' do
+      expect(response).to have_http_status(410)
+    end
+  end
+
+  context 'when an account is not found' do
+    let(:resource) { 'acct:not@existing.com' }
+
+    before do
+      perform_request!
+    end
+
+    it 'returns http not found' do
+      expect(response).to have_http_status(404)
+    end
+  end
+
+  context 'with an alternate domain' do
+    let(:alternate_domains) { ['foo.org'] }
+
+    before do
+      perform_request!
+    end
+
+    context 'when an account exists' do
+      let(:resource) do
+        username, = alice.to_webfinger_s.split('@')
+        "#{username}@foo.org"
+      end
+
+      it_behaves_like 'a successful response'
+    end
+
+    context 'when the domain is wrong' do
+      let(:resource) do
+        username, = alice.to_webfinger_s.split('@')
+        "#{username}@bar.org"
+      end
+
+      it 'returns http not found' do
+        expect(response).to have_http_status(404)
+      end
+    end
+  end
+
+  context 'when the old name scheme is used to query the instance actor' do
+    let(:resource) do
+      "#{Rails.configuration.x.local_domain}@#{Rails.configuration.x.local_domain}"
+    end
+
+    before do
+      perform_request!
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'sets only a Vary Origin header' do
+      expect(response.headers['Vary']).to eq('Origin')
+    end
+
+    it 'returns application/jrd+json' do
+      expect(response.media_type).to eq 'application/jrd+json'
+    end
+
+    it 'returns links for the internal account' do
+      json = body_as_json
+      expect(json[:subject]).to eq 'acct:mastodon.internal@cb6e6126.ngrok.io'
+      expect(json[:aliases]).to eq ['https://cb6e6126.ngrok.io/actor']
+    end
+  end
+
+  context 'with no resource parameter' do
+    let(:resource) { nil }
+
+    before do
+      perform_request!
+    end
+
+    it 'returns http bad request' do
+      expect(response).to have_http_status(400)
+    end
+  end
+
+  context 'with a nonsense parameter' do
+    let(:resource) { 'df/:dfkj' }
+
+    before do
+      perform_request!
+    end
+
+    it 'returns http bad request' do
+      expect(response).to have_http_status(400)
+    end
+  end
+
+  context 'when an account has an avatar' do
+    let(:alice) { Fabricate(:account, username: 'alice', avatar: attachment_fixture('attachment.jpg')) }
+    let(:resource) { alice.to_webfinger_s }
+
+    it 'returns avatar in response' do
+      perform_request!
+
+      avatar_link = get_avatar_link(body_as_json)
+      expect(avatar_link).to_not be_nil
+      expect(avatar_link[:type]).to eq alice.avatar.content_type
+      expect(avatar_link[:href]).to eq Addressable::URI.new(host: Rails.configuration.x.local_domain, path: alice.avatar.to_s, scheme: 'https').to_s
+    end
+
+    context 'with limited federation mode' do
+      before do
+        allow(Rails.configuration.x).to receive(:limited_federation_mode).and_return(true)
+      end
+
+      it 'does not return avatar in response' do
+        perform_request!
+
+        avatar_link = get_avatar_link(body_as_json)
+        expect(avatar_link).to be_nil
+      end
+    end
+
+    context 'when enabling DISALLOW_UNAUTHENTICATED_API_ACCESS' do
+      around do |example|
+        ClimateControl.modify DISALLOW_UNAUTHENTICATED_API_ACCESS: 'true' do
+          example.run
+        end
+      end
+
+      it 'does not return avatar in response' do
+        perform_request!
+
+        avatar_link = get_avatar_link(body_as_json)
+        expect(avatar_link).to be_nil
+      end
+    end
+  end
+
+  context 'when an account does not have an avatar' do
+    let(:alice) { Fabricate(:account, username: 'alice', avatar: nil) }
+    let(:resource) { alice.to_webfinger_s }
+
+    before do
+      perform_request!
+    end
+
+    it 'does not return avatar in response' do
+      avatar_link = get_avatar_link(body_as_json)
+      expect(avatar_link).to be_nil
+    end
+  end
+
+  context 'with different headers' do
+    describe 'requested with standard accepts headers' do
+      it 'returns a json response' do
+        get webfinger_url(resource: alice.to_webfinger_s)
+
+        expect(response).to have_http_status(200)
+        expect(response.media_type).to eq 'application/jrd+json'
+      end
+    end
+
+    describe 'asking for json format' do
+      it 'returns a json response for json format' do
+        get webfinger_url(resource: alice.to_webfinger_s, format: :json)
+
+        expect(response).to have_http_status(200)
+        expect(response.media_type).to eq 'application/jrd+json'
+      end
+
+      it 'returns a json response for json accept header' do
+        headers = { 'HTTP_ACCEPT' => 'application/jrd+json' }
+        get webfinger_url(resource: alice.to_webfinger_s), headers: headers
+
+        expect(response).to have_http_status(200)
+        expect(response.media_type).to eq 'application/jrd+json'
+      end
+    end
+  end
+
+  private
+
+  def get_avatar_link(json)
+    json[:links].find { |link| link[:rel] == 'http://webfinger.net/rel/avatar' }
+  end
+end