Merge remote-tracking branch 'parent/main' into upstream-20240828

spec/requests/anonymous_cookies_spec.rb

@@ -2,7 +2,7 @@
 
 require 'rails_helper'
 
-context 'when visited anonymously' do
+describe 'Anonymous visits' do
   around do |example|
     old = ActionController::Base.allow_forgery_protection
     ActionController::Base.allow_forgery_protection = true

spec/requests/api/oembed_spec.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'API OEmbed' do
+  describe 'GET /api/oembed' do
+    before { host! Rails.configuration.x.local_domain }
+
+    context 'when status is public' do
+      let(:status) { Fabricate(:status, visibility: :public) }
+
+      it 'returns success with private cache control headers' do
+        get '/api/oembed', params: { url: short_account_status_url(status.account, status) }
+
+        expect(response)
+          .to have_http_status(200)
+        expect(response.headers['Cache-Control'])
+          .to include('private, no-store')
+      end
+    end
+
+    context 'when status is not public' do
+      let(:status) { Fabricate(:status, visibility: :direct) }
+
+      it 'returns not found' do
+        get '/api/oembed', params: { url: short_account_status_url(status.account, status) }
+
+        expect(response)
+          .to have_http_status(404)
+      end
+    end
+  end
+end

spec/requests/api/web/settings_spec.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe '/api/web/settings' do
+  describe 'PATCH /api/web/settings' do
+    let(:user) { Fabricate :user }
+
+    context 'when signed in' do
+      before { sign_in(user) }
+
+      it 'updates setting and responds with success' do
+        patch '/api/web/settings', params: { data: { 'onboarded' => true } }
+
+        expect(user_web_setting.data)
+          .to include('onboarded' => 'true')
+
+        expect(response)
+          .to have_http_status(200)
+      end
+    end
+
+    context 'when not signed in' do
+      it 'responds with unprocessable and does not modify setting' do
+        patch '/api/web/settings', params: { data: { 'onboarded' => true } }
+
+        expect(user_web_setting)
+          .to be_nil
+
+        expect(response)
+          .to have_http_status(422)
+      end
+    end
+
+    def user_web_setting
+      Web::Setting
+        .where(user: user)
+        .first
+    end
+  end
+end

spec/requests/custom_stylesheets_spec.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe 'Custom stylesheets' do
+  describe 'GET /custom.css' do
+    before { get '/custom.css' }
+
+    it 'returns http success' do
+      expect(response)
+        .to have_http_status(200)
+        .and have_attributes(
+          content_type: match('text/css')
+        )
+    end
+
+    it_behaves_like 'cacheable response'
+  end
+end

spec/requests/emojis_spec.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe 'Emojis' do
+  describe 'GET /emojis/:id' do
+    let(:emoji) { Fabricate(:custom_emoji, shortcode: 'coolcat') }
+
+    it 'returns http success with correct json' do
+      get "/emojis/#{emoji.id}"
+
+      expect(response)
+        .to have_http_status(200)
+      expect(body_as_json)
+        .to include(
+          name: ':coolcat:',
+          type: 'Emoji'
+        )
+    end
+  end
+end

spec/requests/health_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe 'Health check endpoint' do
+  describe 'GET /health' do
+    it 'returns http success when server is functioning' do
+      get '/health'
+
+      expect(response)
+        .to have_http_status(200)
+      expect(response.body)
+        .to include('OK')
+    end
+  end
+end

spec/requests/instance_actor_spec.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Instance actor endpoint' do
+  describe 'GET /actor' do
+    before do
+      integration_session.https! # TODO: Move to global rails_helper for all request specs?
+      host! Rails.configuration.x.local_domain # TODO: Move to global rails_helper for all request specs?
+    end
+
+    let!(:original_federation_mode) { Rails.configuration.x.limited_federation_mode }
+
+    shared_examples 'instance actor endpoint' do
+      before { get instance_actor_path(format: :json) }
+
+      it 'returns http success with correct media type and body' do
+        expect(response)
+          .to have_http_status(200)
+        expect(response.content_type)
+          .to start_with('application/activity+json')
+        expect(body_as_json)
+          .to include(
+            id: instance_actor_url,
+            type: 'Application',
+            preferredUsername: 'mastodon.internal',
+            inbox: instance_actor_inbox_url,
+            outbox: instance_actor_outbox_url,
+            publicKey: include(
+              id: instance_actor_url(anchor: 'main-key')
+            ),
+            url: about_more_url(instance_actor: true)
+          )
+      end
+
+      it_behaves_like 'cacheable response'
+    end
+
+    context 'with limited federation mode disabled' do
+      before { Rails.configuration.x.limited_federation_mode = false }
+      after { Rails.configuration.x.limited_federation_mode = original_federation_mode }
+
+      it_behaves_like 'instance actor endpoint'
+
+      context 'with a disabled instance actor' do
+        before { disable_instance_actor }
+
+        it_behaves_like 'instance actor endpoint'
+      end
+    end
+
+    context 'with limited federation mode enabled' do
+      before { Rails.configuration.x.limited_federation_mode = true }
+      after { Rails.configuration.x.limited_federation_mode = original_federation_mode }
+
+      it_behaves_like 'instance actor endpoint'
+
+      context 'with a disabled instance actor' do
+        before { disable_instance_actor }
+
+        it_behaves_like 'instance actor endpoint'
+      end
+    end
+
+    def disable_instance_actor
+      Account
+        .representative
+        .update(suspended_at: 10.days.ago)
+    end
+  end
+end

spec/requests/manifest_spec.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe 'Manifest' do
+  describe 'GET /manifest' do
+    before { get '/manifest' }
+
+    it 'returns http success' do
+      expect(response)
+        .to have_http_status(200)
+        .and have_attributes(
+          content_type: match('application/json')
+        )
+      expect(body_as_json)
+        .to include(
+          id: '/home',
+          name: 'Mastodon'
+        )
+    end
+
+    it_behaves_like 'cacheable response'
+  end
+end

spec/requests/media_proxy_spec.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe 'Media Proxy' do
+  describe 'GET /media_proxy/:id' do
+    before do
+      integration_session.https! # TODO: Move to global rails_helper for all request specs?
+      host! Rails.configuration.x.local_domain # TODO: Move to global rails_helper for all request specs?
+
+      stub_request(:get, 'http://example.com/attachment.png').to_return(request_fixture('avatar.txt'))
+    end
+
+    context 'when attached to a status' do
+      let(:status) { Fabricate(:status) }
+      let(:media_attachment) { Fabricate(:media_attachment, status: status, remote_url: 'http://example.com/attachment.png') }
+
+      it 'redirects to correct original url' do
+        get "/media_proxy/#{media_attachment.id}"
+
+        expect(response)
+          .to have_http_status(302)
+          .and redirect_to media_attachment.file.url(:original)
+      end
+
+      it 'redirects to small style url' do
+        get "/media_proxy/#{media_attachment.id}/small"
+
+        expect(response)
+          .to have_http_status(302)
+          .and redirect_to media_attachment.file.url(:small)
+      end
+    end
+
+    context 'when there is not an attached status' do
+      let(:media_attachment) { Fabricate(:media_attachment, status: status, remote_url: 'http://example.com/attachment.png') }
+
+      it 'responds with missing' do
+        get "/media_proxy/#{media_attachment.id}"
+
+        expect(response)
+          .to have_http_status(404)
+      end
+    end
+
+    context 'when id cannot be found' do
+      it 'responds with missing' do
+        get '/media_proxy/missing'
+
+        expect(response)
+          .to have_http_status(404)
+      end
+    end
+
+    context 'when not permitted to view' do
+      let(:status) { Fabricate(:status, visibility: :direct) }
+      let(:media_attachment) { Fabricate(:media_attachment, status: status, remote_url: 'http://example.com/attachment.png') }
+
+      it 'responds with missing' do
+        get "/media_proxy/#{media_attachment.id}"
+
+        expect(response)
+          .to have_http_status(404)
+      end
+    end
+  end
+end

spec/requests/settings/exports/blocked_accounts_spec.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe 'Settings / Exports / Blocked Accounts' do
+  describe 'GET /settings/exports/blocks' do
+    context 'with a signed in user who has blocked accounts' do
+      let(:user) { Fabricate :user }
+
+      before do
+        Fabricate(
+          :block,
+          account: user.account,
+          target_account: Fabricate(:account, username: 'username', domain: 'domain')
+        )
+        sign_in user
+      end
+
+      it 'returns a CSV with the blocking accounts' do
+        get '/settings/exports/blocks.csv'
+
+        expect(response)
+          .to have_http_status(200)
+        expect(response.content_type)
+          .to eq('text/csv')
+        expect(response.body)
+          .to eq(<<~CSV)
+            username@domain
+          CSV
+      end
+    end
+
+    describe 'when signed out' do
+      it 'returns unauthorized' do
+        get '/settings/exports/blocks.csv'
+
+        expect(response)
+          .to have_http_status(401)
+      end
+    end
+  end
+end

spec/requests/settings/exports/blocked_domains_spec.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe 'Settings / Exports / Blocked Domains' do
+  describe 'GET /settings/exports/domain_blocks' do
+    context 'with a signed in user who has blocked domains' do
+      let(:account) { Fabricate :account, domain: 'example.com' }
+      let(:user) { Fabricate :user, account: account }
+
+      before do
+        Fabricate(:account_domain_block, domain: 'example.com', account: account)
+        sign_in user
+      end
+
+      it 'returns a CSV with the domains' do
+        get '/settings/exports/domain_blocks.csv'
+
+        expect(response)
+          .to have_http_status(200)
+        expect(response.content_type)
+          .to eq('text/csv')
+        expect(response.body)
+          .to eq(<<~CSV)
+            example.com
+          CSV
+      end
+    end
+
+    describe 'when signed out' do
+      it 'returns unauthorized' do
+        get '/settings/exports/domain_blocks.csv'
+
+        expect(response)
+          .to have_http_status(401)
+      end
+    end
+  end
+end

spec/requests/settings/exports/bookmarks_spec.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe 'Settings / Exports / Bookmarks' do
+  describe 'GET /settings/exports/bookmarks' do
+    context 'with a signed in user who has bookmarks' do
+      let(:account) { Fabricate(:account, domain: 'foo.bar') }
+      let(:status) { Fabricate(:status, account: account, uri: 'https://foo.bar/statuses/1312') }
+      let(:user) { Fabricate(:user) }
+
+      before do
+        Fabricate(
+          :bookmark,
+          account: user.account,
+          status: status
+        )
+        sign_in user
+      end
+
+      it 'returns a CSV with the bookmarked statuses' do
+        get '/settings/exports/bookmarks.csv'
+
+        expect(response)
+          .to have_http_status(200)
+        expect(response.content_type)
+          .to eq('text/csv')
+        expect(response.body)
+          .to eq(<<~CSV)
+            https://foo.bar/statuses/1312
+          CSV
+      end
+    end
+
+    describe 'when signed out' do
+      it 'returns unauthorized' do
+        get '/settings/exports/bookmarks.csv'
+
+        expect(response)
+          .to have_http_status(401)
+      end
+    end
+  end
+end

spec/requests/settings/exports/following_accounts_spec.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe 'Settings / Exports / Following Accounts' do
+  describe 'GET /settings/exports/follows' do
+    context 'with a signed in user who is following accounts' do
+      let(:user) { Fabricate :user }
+
+      before do
+        Fabricate(
+          :follow,
+          account: user.account,
+          target_account: Fabricate(:account, username: 'username', domain: 'domain'),
+          languages: ['en']
+        )
+        sign_in user
+      end
+
+      it 'returns a CSV with the accounts' do
+        get '/settings/exports/follows.csv'
+
+        expect(response)
+          .to have_http_status(200)
+        expect(response.content_type)
+          .to eq('text/csv')
+        expect(response.body)
+          .to eq(<<~CSV)
+            Account address,Show boosts,Notify on new posts,Languages
+            username@domain,true,false,en
+          CSV
+      end
+    end
+
+    describe 'when signed out' do
+      it 'returns unauthorized' do
+        get '/settings/exports/follows.csv'
+
+        expect(response)
+          .to have_http_status(401)
+      end
+    end
+  end
+end

spec/requests/settings/exports/lists_spec.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe 'Settings / Exports / Lists' do
+  describe 'GET /settings/exports/lists' do
+    context 'with a signed in user who has lists' do
+      let(:account) { Fabricate(:account, username: 'test', domain: 'example.com') }
+      let(:list) { Fabricate :list, account: account, title: 'The List' }
+      let(:user) { Fabricate(:user, account: account) }
+
+      before do
+        Fabricate(:list_account, list: list, account: account)
+        sign_in user
+      end
+
+      it 'returns a CSV with the list' do
+        get '/settings/exports/lists.csv'
+
+        expect(response)
+          .to have_http_status(200)
+        expect(response.content_type)
+          .to eq('text/csv')
+        expect(response.body)
+          .to eq(<<~CSV)
+            The List,test@example.com
+          CSV
+      end
+    end
+
+    describe 'when signed out' do
+      it 'returns unauthorized' do
+        get '/settings/exports/lists.csv'
+
+        expect(response)
+          .to have_http_status(401)
+      end
+    end
+  end
+end

spec/requests/settings/exports/muted_accounts_spec.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe 'Settings / Exports / Muted Accounts' do
+  describe 'GET /settings/exports/mutes' do
+    context 'with a signed in user who has muted accounts' do
+      let(:user) { Fabricate :user }
+
+      before do
+        Fabricate(
+          :mute,
+          account: user.account,
+          target_account: Fabricate(:account, username: 'username', domain: 'domain')
+        )
+        sign_in user
+      end
+
+      it 'returns a CSV with the muted accounts' do
+        get '/settings/exports/mutes.csv'
+
+        expect(response)
+          .to have_http_status(200)
+        expect(response.content_type)
+          .to eq('text/csv')
+        expect(response.body)
+          .to eq(<<~CSV)
+            Account address,Hide notifications
+            username@domain,true
+          CSV
+      end
+    end
+
+    describe 'when signed out' do
+      it 'returns unauthorized' do
+        get '/settings/exports/mutes.csv'
+
+        expect(response)
+          .to have_http_status(401)
+      end
+    end
+  end
+end