Merge remote-tracking branch 'parent/main' into upstream-20250328

spec/system/account_notes_spec.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Account notes', :inline_jobs, :js, :streaming do
+  include ProfileStories
+
+  let(:email)               { 'test@example.com' }
+  let(:password)            { 'password' }
+  let(:confirmed_at)        { Time.zone.now }
+  let(:finished_onboarding) { true }
+
+  let!(:other_account) { Fabricate(:account) }
+
+  before { as_a_logged_in_user }
+
+  it 'can be written and viewed' do
+    visit_profile(other_account)
+
+    note_text = 'This is a personal note'
+    fill_in 'Click to add note', with: note_text
+
+    # This is a bit awkward since there is no button to save the change
+    # The easiest way is to send ctrl+enter ourselves
+    find_field(class: 'account__header__account-note__content').send_keys [:control, :enter]
+
+    within('.account__header__account-note .inline-alert') do
+      expect(page)
+        .to have_content('SAVED')
+    end
+
+    expect(page)
+      .to have_css('.account__header__account-note__content', text: note_text)
+
+    # Navigate back and forth and ensure the comment is still here
+    visit root_url
+    visit_profile(other_account)
+
+    expect(AccountNote.find_by(account: bob.account, target_account: other_account).comment)
+      .to eq note_text
+
+    expect(page)
+      .to have_css('.account__header__account-note__content', text: note_text)
+  end
+
+  def visit_profile(account)
+    visit short_account_path(account)
+
+    expect(page)
+      .to have_css('div.app-holder')
+      .and have_css('form.compose-form')
+  end
+end

spec/system/admin/account_actions_spec.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Account Actions' do
+  let(:user) { Fabricate(:admin_user) }
+
+  before { sign_in user }
+
+  describe 'Creating a new account action on an account' do
+    let(:account) { Fabricate(:account) }
+
+    it 'creates the action and redirects to the account page' do
+      visit new_admin_account_action_path(account_id: account.id)
+      expect(page)
+        .to have_title(I18n.t('admin.account_actions.title', acct: account.pretty_acct))
+
+      choose(option: 'silence')
+      expect { submit_form }
+        .to change { account.strikes.count }.by(1)
+      expect(page)
+        .to have_title(account.pretty_acct)
+    end
+
+    def submit_form
+      click_on I18n.t('admin.account_actions.action')
+    end
+  end
+end

spec/system/admin/action_logs_spec.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Action Logs' do
+  # Action logs typically cause issues when their targets are not in the database
+  let!(:account) { Fabricate(:account) }
+
+  before do
+    populate_action_logs
+    sign_in Fabricate(:admin_user)
+  end
+
+  describe 'Viewing action logs' do
+    it 'shows page with action logs listed' do
+      visit admin_action_logs_path
+
+      expect(page)
+        .to have_title(I18n.t('admin.action_logs.title'))
+        .and have_css('.log-entry')
+    end
+  end
+
+  private
+
+  def populate_action_logs
+    orphaned_log_types.map do |type|
+      Fabricate(:action_log, account: account, action: 'destroy', target_type: type, target_id: 1312)
+    end
+  end
+
+  def orphaned_log_types
+    %w(
+      Account
+      AccountWarning
+      Announcement
+      Appeal
+      CanonicalEmailBlock
+      CustomEmoji
+      DomainAllow
+      DomainBlock
+      EmailDomainBlock
+      Instance
+      IpBlock
+      Report
+      Status
+      UnavailableDomain
+      User
+      UserRole
+    )
+  end
+end

spec/system/admin/change_emails_spec.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Change Emails' do
+  let(:admin) { Fabricate(:admin_user) }
+
+  before { sign_in admin }
+
+  describe 'Changing the email address for a user', :inline_jobs do
+    let(:user) { Fabricate :user }
+
+    it 'updates user details and sends email' do
+      visit admin_account_change_email_path(user.account.id)
+      expect(page)
+        .to have_title(I18n.t('admin.accounts.change_email.title', username: user.account.username))
+
+      fill_in 'user_unconfirmed_email', with: 'test@host.example'
+      emails = capture_emails { process_change_email }
+      expect(emails.first)
+        .to be_present
+        .and(deliver_to('test@host.example'))
+        .and(have_subject(/Confirm email/))
+      expect(page)
+        .to have_title(user.account.pretty_acct)
+    end
+
+    def process_change_email
+      expect { click_on I18n.t('admin.accounts.change_email.submit') }
+        .to not_change { user.reload.email }
+        .and(change { user.reload.unconfirmed_email }.to('test@host.example'))
+        .and(change { user.reload.confirmation_token }.from(nil).to(be_present))
+    end
+  end
+end

spec/system/admin/dashboard_spec.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Dashboard' do
+  describe 'Viewing the dashboard page' do
+    let(:user) { Fabricate(:owner_user) }
+
+    before do
+      stub_system_checks
+      Fabricate :software_update
+      sign_in(user)
+    end
+
+    it 'returns page with system check messages' do
+      visit admin_dashboard_path
+
+      expect(page)
+        .to have_title(I18n.t('admin.dashboard.title'))
+        .and have_content(I18n.t('admin.system_checks.software_version_patch_check.message_html'))
+    end
+
+    private
+
+    def stub_system_checks
+      stub_const 'Admin::SystemCheck::ACTIVE_CHECKS', [
+        Admin::SystemCheck::SoftwareVersionCheck,
+      ]
+    end
+  end
+end

spec/system/admin/users/two_factor_authentications_spec.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+require 'webauthn/fake_client'
+
+RSpec.describe 'Admin Users TwoFactorAuthentications' do
+  let(:user) { Fabricate(:user) }
+
+  before { sign_in Fabricate(:admin_user) }
+
+  describe 'Disabling 2FA for users' do
+    before { stub_webauthn_credential }
+
+    let(:fake_client) { WebAuthn::FakeClient.new('http://test.host') }
+
+    context 'when user has OTP enabled' do
+      before { user.update(otp_required_for_login: true) }
+
+      it 'disables OTP and redirects to admin account page' do
+        visit admin_account_path(user.account.id)
+
+        expect { disable_two_factor }
+          .to change { user.reload.otp_enabled? }.to(false)
+        expect(page)
+          .to have_title(user.account.pretty_acct)
+      end
+    end
+
+    context 'when user has OTP and WebAuthn enabled' do
+      before { user.update(otp_required_for_login: true, webauthn_id: WebAuthn.generate_user_id) }
+
+      it 'disables OTP and webauthn and redirects to admin account page' do
+        visit admin_account_path(user.account.id)
+
+        expect { disable_two_factor }
+          .to change { user.reload.otp_enabled? }.to(false)
+          .and(change { user.reload.webauthn_enabled? }.to(false))
+        expect(page)
+          .to have_title(user.account.pretty_acct)
+      end
+    end
+
+    def disable_two_factor
+      click_on I18n.t('admin.accounts.disable_two_factor_authentication')
+    end
+
+    def stub_webauthn_credential
+      public_key_credential = WebAuthn::Credential.from_create(fake_client.create)
+      Fabricate(
+        :webauthn_credential,
+        external_id: public_key_credential.id,
+        nickname: 'Security Key',
+        public_key: public_key_credential.public_key,
+        user_id: user.id
+      )
+    end
+  end
+end

spec/system/disputes/strikes_spec.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Disputes Strikes' do
+  before { sign_in(current_user) }
+
+  describe 'viewing strike disputes' do
+    let(:current_user) { Fabricate(:user) }
+    let!(:strike) { Fabricate(:account_warning, target_account: current_user.account) }
+
+    it 'shows a list of strikes and details for each' do
+      visit disputes_strikes_path
+      expect(page)
+        .to have_title(I18n.t('settings.strikes'))
+
+      find('.strike-entry').click
+      expect(page)
+        .to have_title(strike_page_title)
+        .and have_content(strike.text)
+    end
+
+    def strike_page_title
+      I18n.t('disputes.strikes.title', action: I18n.t(strike.action, scope: 'disputes.strikes.title_actions'), date: I18n.l(strike.created_at.to_date))
+    end
+  end
+end

spec/system/filters/statuses_spec.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Filters Statuses' do
+  describe 'Viewing statuses under a filter' do
+    let(:filter) { Fabricate(:custom_filter, title: 'good filter') }
+
+    context 'with the filter user signed in' do
+      before { sign_in(filter.account.user) }
+
+      it 'returns a page with the status filters' do
+        visit filter_statuses_path(filter)
+
+        expect(page)
+          .to have_private_cache_control
+          .and have_title(/good filter/)
+      end
+    end
+  end
+end

spec/system/settings/deletes_spec.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Settings Deletes' do
+  describe 'Deleting user from settings area' do
+    let(:user) { Fabricate(:user) }
+
+    before { sign_in(user) }
+
+    it 'requires password and deletes user record', :inline_jobs do
+      visit settings_delete_path
+      expect(page)
+        .to have_title(I18n.t('settings.delete'))
+        .and have_private_cache_control
+
+      # Wrong confirmation value
+      fill_in 'form_delete_confirmation_password', with: 'wrongvalue'
+      click_on I18n.t('deletes.proceed')
+      expect(page)
+        .to have_content(I18n.t('deletes.challenge_not_passed'))
+
+      # Correct confirmation value
+      fill_in 'form_delete_confirmation_password', with: user.password
+      click_on I18n.t('deletes.proceed')
+      expect(page)
+        .to have_content(I18n.t('deletes.success_msg'))
+      expect(page)
+        .to have_title(I18n.t('auth.login'))
+      expect(User.find_by(id: user.id))
+        .to be_nil
+      expect(user.account.reload)
+        .to be_suspended
+      expect(CanonicalEmailBlock.block?(user.email))
+        .to be(false)
+    end
+  end
+end