Merge remote-tracking branch 'parent/main' into upstream-20240123

spec/requests/api/v1/accounts/credentials_spec.rb

@@ -64,6 +64,7 @@ RSpec.describe 'credentials API' do
         indexable: true,
         locked: false,
         note: 'Hello!',
+        attribution_domains: ['example.com'],
         source: {
           privacy: 'unlisted',
           sensitive: true,
@@ -121,7 +122,8 @@ RSpec.describe 'credentials API' do
           display_name: eq("Alice Isn't Dead"),
           note: 'Hello!',
           avatar: exist,
-          header: exist
+          header: exist,
+          attribution_domains: ['example.com']
         )
     end
 

spec/requests/api/v1/push/subscriptions_spec.rb

@@ -107,6 +107,13 @@ RSpec.describe 'API V1 Push Subscriptions' do
 
       it_behaves_like 'validation error'
     end
+
+    it 'gracefully handles invalid nested params' do
+      post api_v1_push_subscription_path, params: { subscription: 'invalid' }, headers: headers
+
+      expect(response)
+        .to have_http_status(400)
+    end
   end
 
   describe 'PUT /api/v1/push/subscription' do
@@ -133,6 +140,13 @@ RSpec.describe 'API V1 Push Subscriptions' do
           policy: alerts_payload[:data][:policy]
         )
     end
+
+    it 'gracefully handles invalid nested params' do
+      put api_v1_push_subscription_path(endpoint_push_subscription), params: { data: 'invalid' }, headers: headers
+
+      expect(response)
+        .to have_http_status(400)
+    end
   end
 
   describe 'GET /api/v1/push/subscription' do

spec/requests/api/web/push_subscriptions_spec.rb

@@ -52,4 +52,28 @@ RSpec.describe 'API Web Push Subscriptions' do
       end
     end
   end
+
+  describe 'POST /api/web/push_subscriptions' do
+    before { sign_in Fabricate :user }
+
+    it 'gracefully handles invalid nested params' do
+      post api_web_push_subscriptions_path, params: { subscription: 'invalid' }
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+
+  describe 'PUT /api/web/push_subscriptions' do
+    before { sign_in Fabricate :user }
+
+    let(:subscription) { Fabricate :web_push_subscription }
+
+    it 'gracefully handles invalid nested params' do
+      put api_web_push_subscription_path(subscription), params: { data: 'invalid' }
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
 end

spec/requests/auth/setup_spec.rb

@@ -24,4 +24,15 @@ RSpec.describe 'Auth Setup' do
       end
     end
   end
+
+  describe 'PUT /auth/setup' do
+    before { sign_in Fabricate(:user, confirmed_at: nil) }
+
+    it 'gracefully handles invalid nested params' do
+      put '/auth/setup?user=invalid'
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
 end

spec/requests/disputes/appeals_spec.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Disputes Appeals' do
+  describe 'POST /disputes/appeals' do
+    before { sign_in strike.target_account.user }
+
+    let(:strike) { Fabricate :account_warning }
+
+    it 'gracefully handles invalid nested params' do
+      post disputes_strike_appeal_path(strike, appeal: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/filters_spec.rb

@@ -13,4 +13,28 @@ RSpec.describe 'Filters' do
       end
     end
   end
+
+  describe 'POST /filters' do
+    before { sign_in Fabricate :user }
+
+    it 'gracefully handles invalid nested params' do
+      post filters_path(custom_filter: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+
+  describe 'PUT /filters/:id' do
+    before { sign_in(filter.account.user) }
+
+    let(:filter) { Fabricate :custom_filter }
+
+    it 'gracefully handles invalid nested params' do
+      put filter_path(filter, custom_filter: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
 end

spec/requests/invites_spec.rb

@@ -28,4 +28,13 @@ RSpec.describe 'Invites' do
       end
     end
   end
+
+  describe 'POST /invites' do
+    it 'gracefully handles invalid nested params' do
+      post invites_path(invite: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
 end

spec/requests/settings/aliases_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Settings Aliases' do
+  describe 'POST /settings/aliases' do
+    before { sign_in Fabricate(:user) }
+
+    it 'gracefully handles invalid nested params' do
+      post settings_aliases_path(account_alias: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/settings/deletes_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Settings Deletes' do
+  describe 'DELETE /settings/delete' do
+    before { sign_in Fabricate(:user) }
+
+    it 'gracefully handles invalid nested params' do
+      delete settings_delete_path(form_delete_confirmation: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/settings/featured_tags_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Settings Aliases' do
+  describe 'POST /settings/featured_tags' do
+    before { sign_in Fabricate(:user) }
+
+    it 'gracefully handles invalid nested params' do
+      post settings_featured_tags_path(featured_tag: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/settings/imports_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Settings Imports' do
+  describe 'POST /settings/imports' do
+    before { sign_in Fabricate(:user) }
+
+    it 'gracefully handles invalid nested params' do
+      post settings_imports_path(form_import: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/settings/migration/redirects_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Settings Migration Redirects' do
+  describe 'POST /settings/migration/redirect' do
+    before { sign_in Fabricate(:user) }
+
+    it 'gracefully handles invalid nested params' do
+      post settings_migration_redirect_path(form_redirect: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/settings/migrations_spec.rb

@@ -18,4 +18,15 @@ RSpec.describe 'Settings Migrations' do
       it { is_expected.to redirect_to new_user_session_path }
     end
   end
+
+  context 'when user is signed in' do
+    before { sign_in Fabricate(:user) }
+
+    it 'gracefully handles invalid nested params' do
+      post settings_migration_path(account_migration: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
 end

spec/requests/settings/privacy_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Settings Privacy' do
+  describe 'PUT /settings/privacy' do
+    before { sign_in Fabricate(:user) }
+
+    it 'gracefully handles invalid nested params' do
+      put settings_privacy_path(account: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/settings/profiles_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Settings Profiles' do
+  describe 'PUT /settings/profile' do
+    before { sign_in Fabricate(:user) }
+
+    it 'gracefully handles invalid nested params' do
+      put settings_profile_path(account: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/statuses_cleanup_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Statuses Cleanup' do
+  describe 'PUT /statuses_cleanup' do
+    before { sign_in Fabricate(:user) }
+
+    it 'gracefully handles invalid nested params' do
+      put statuses_cleanup_path(account_statuses_cleanup_policy: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/statuses_spec.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Statuses' do
+  describe 'GET /@:account_username/:id' do
+    let(:account) { Fabricate(:account) }
+    let(:status)  { Fabricate(:status, account: account) }
+
+    context 'when signed out' do
+      context 'when account is permanently suspended' do
+        before do
+          account.suspend!
+          account.deletion_request.destroy
+        end
+
+        it 'returns http gone' do
+          get "/@#{account.username}/#{status.id}"
+
+          expect(response)
+            .to have_http_status(410)
+        end
+      end
+
+      context 'when account is temporarily suspended' do
+        before { account.suspend! }
+
+        it 'returns http forbidden' do
+          get "/@#{account.username}/#{status.id}"
+
+          expect(response)
+            .to have_http_status(403)
+        end
+      end
+
+      context 'when status is a reblog' do
+        let(:original_account) { Fabricate(:account, domain: 'example.com') }
+        let(:original_status) { Fabricate(:status, account: original_account, url: 'https://example.com/123') }
+        let(:status) { Fabricate(:status, account: account, reblog: original_status) }
+
+        it 'redirects to the original status' do
+          get "/@#{status.account.username}/#{status.id}"
+
+          expect(response)
+            .to redirect_to(original_status.url)
+        end
+      end
+    end
+
+    context 'when signed in' do
+      let(:user) { Fabricate(:user) }
+
+      before { sign_in(user) }
+
+      context 'when account blocks user' do
+        before { account.block!(user.account) }
+
+        it 'returns http not found' do
+          get "/@#{status.account.username}/#{status.id}"
+
+          expect(response)
+            .to have_http_status(404)
+        end
+      end
+    end
+  end
+end