spec/controllers/activitypub/collections_controller_spec.rb

   1 # frozen_string_literal: true
   2
   3 require 'rails_helper'
   4
   5 RSpec.describe ActivityPub::CollectionsController, type: :controller do
   6   let!(:account) { Fabricate(:account) }
   7   let!(:private_pinned) { Fabricate(:status, account: account, text: 'secret private stuff', visibility: :private) }
   8   let(:remote_account) { nil }
   9
  10   shared_examples 'cacheable response' do
  11     it 'does not set cookies' do
  12       expect(response.cookies).to be_empty
  13       expect(response.headers['Set-Cookies']).to be nil
  14     end
  15
  16     it 'does not set sessions' do
  17       response
  18       expect(session).to be_empty
  19     end
  20
  21     it 'returns public Cache-Control header' do
  22       expect(response.headers['Cache-Control']).to include 'public'
  23     end
  24   end
  25
  26   before do
  27     allow(controller).to receive(:signed_request_account).and_return(remote_account)
  28
  29     Fabricate(:status_pin, account: account)
  30     Fabricate(:status_pin, account: account)
  31     Fabricate(:status_pin, account: account, status: private_pinned)
  32     Fabricate(:status, account: account, visibility: :private)
  33   end
  34
  35   describe 'GET #show' do
  36     context 'when id is "featured"' do
  37       context 'without signature' do
  38         let(:remote_account) { nil }
  39
  40         subject(:response) { get :show, params: { id: 'featured', account_username: account.username } }
  41         subject(:body) { body_as_json }
  42
  43         it 'returns http success' do
  44           expect(response).to have_http_status(200)
  45         end
  46
  47         it 'returns application/activity+json' do
  48           expect(response.media_type).to eq 'application/activity+json'
  49         end
  50
  51         it_behaves_like 'cacheable response'
  52
  53         it 'returns orderedItems with pinned statuses' do
  54           expect(body[:orderedItems]).to be_an Array
  55           expect(body[:orderedItems].size).to eq 3
  56         end
  57
  58         it 'includes URI of private pinned status' do
  59           expect(body[:orderedItems]).to include(ActivityPub::TagManager.instance.uri_for(private_pinned))
  60         end
  61
  62         it 'does not include contents of private pinned status' do
  63           expect(response.body).not_to include(private_pinned.text)
  64         end
  65
  66         context 'when account is permanently suspended' do
  67           before do
  68             account.suspend!
  69             account.deletion_request.destroy
  70           end
  71
  72           it 'returns http gone' do
  73             expect(response).to have_http_status(410)
  74           end
  75         end
  76
  77         context 'when account is temporarily suspended' do
  78           before do
  79             account.suspend!
  80           end
  81
  82           it 'returns http forbidden' do
  83             expect(response).to have_http_status(403)
  84           end
  85         end
  86       end
  87
  88       context 'with signature' do
  89         let(:remote_account) { Fabricate(:account, domain: 'example.com') }
  90
  91         context do
  92           before do
  93             get :show, params: { id: 'featured', account_username: account.username }
  94           end
  95
  96           it 'returns http success' do
  97             expect(response).to have_http_status(200)
  98           end
  99
 100           it 'returns application/activity+json' do
 101             expect(response.media_type).to eq 'application/activity+json'
 102           end
 103
 104           it_behaves_like 'cacheable response'
 105
 106           it 'returns orderedItems with pinned statuses' do
 107             json = body_as_json
 108             expect(json[:orderedItems]).to be_an Array
 109             expect(json[:orderedItems].size).to eq 3
 110           end
 111
 112           it 'includes URI of private pinned status' do
 113             json = body_as_json
 114             expect(json[:orderedItems]).to include(ActivityPub::TagManager.instance.uri_for(private_pinned))
 115           end
 116
 117           it 'does not include contents of private pinned status' do
 118             expect(response.body).not_to include(private_pinned.text)
 119           end
 120         end
 121
 122         context 'in authorized fetch mode' do
 123           before do
 124             allow(controller).to receive(:authorized_fetch_mode?).and_return(true)
 125           end
 126
 127           context 'when signed request account is blocked' do
 128             before do
 129               account.block!(remote_account)
 130               get :show, params: { id: 'featured', account_username: account.username }
 131             end
 132
 133             it 'returns http success' do
 134               expect(response).to have_http_status(200)
 135             end
 136
 137             it 'returns application/activity+json' do
 138               expect(response.media_type).to eq 'application/activity+json'
 139             end
 140
 141             it 'returns private Cache-Control header' do
 142               expect(response.headers['Cache-Control']).to include 'private'
 143             end
 144
 145             it 'returns empty orderedItems' do
 146               json = body_as_json
 147               expect(json[:orderedItems]).to be_an Array
 148               expect(json[:orderedItems].size).to eq 0
 149             end
 150           end
 151
 152           context 'when signed request account is domain blocked' do
 153             before do
 154               account.block_domain!(remote_account.domain)
 155               get :show, params: { id: 'featured', account_username: account.username }
 156             end
 157
 158             it 'returns http success' do
 159               expect(response).to have_http_status(200)
 160             end
 161
 162             it 'returns application/activity+json' do
 163               expect(response.media_type).to eq 'application/activity+json'
 164             end
 165
 166             it 'returns private Cache-Control header' do
 167               expect(response.headers['Cache-Control']).to include 'private'
 168             end
 169
 170             it 'returns empty orderedItems' do
 171               json = body_as_json
 172               expect(json[:orderedItems]).to be_an Array
 173               expect(json[:orderedItems].size).to eq 0
 174             end
 175           end
 176         end
 177       end
 178     end
 179
 180     context 'when id is not "featured"' do
 181       it 'returns http not found' do
 182         get :show, params: { id: 'hoge', account_username: account.username }
 183         expect(response).to have_http_status(404)
 184       end
 185     end
 186   end
 187 end