No OneTemporary
Actions

Authored By

Unknown

Size

44 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/lib/pleroma/object/fetcher.ex b/lib/pleroma/object/fetcher.ex
	index 5bc1cfd5e..0c90e0eaa 100644
	--- a/lib/pleroma/object/fetcher.ex
	+++ b/lib/pleroma/object/fetcher.ex
	@@ -1,238 +1,238 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Object.Fetcher do
	alias Pleroma.HTTP
	alias Pleroma.Instances
	alias Pleroma.Maps
	alias Pleroma.Object
	alias Pleroma.Object.Containment
	alias Pleroma.Signature
	alias Pleroma.Web.ActivityPub.InternalFetchActor
	alias Pleroma.Web.ActivityPub.MRF
	alias Pleroma.Web.ActivityPub.ObjectValidator
	alias Pleroma.Web.ActivityPub.Pipeline
	alias Pleroma.Web.ActivityPub.Transmogrifier
	alias Pleroma.Web.Federator

	require Logger
	require Pleroma.Constants

	@spec reinject_object(struct(), map()) :: {:ok, Object.t()} \| {:error, any()}
	defp reinject_object(%Object{data: %{}} = object, new_data) do
	Logger.debug("Reinjecting object #{new_data["id"]}")

	with {:ok, new_data, _} <- ObjectValidator.validate(new_data, %{}),
	{:ok, new_data} <- MRF.filter(new_data),
	{:ok, new_object, _} <-
	Object.Updater.do_update_and_invalidate_cache(
	object,
	new_data,
	_touch_changeset? = true
	) do
	{:ok, new_object}
	else
	e ->
	Logger.error("Error while processing object: #{inspect(e)}")
	{:error, e}
	end
	end

	defp reinject_object(_, new_data) do
	with {:ok, object, _} <- Pipeline.common_pipeline(new_data, local: false) do
	{:ok, object}
	else
	e -> e
	end
	end

	def refetch_object(%Object{data: %{"id" => id}} = object) do
	with {:local, false} <- {:local, Object.local?(object)},
	{:ok, new_data} <- fetch_and_contain_remote_object_from_id(id),
	{:ok, object} <- reinject_object(object, new_data) do
	{:ok, object}
	else
	{:local, true} -> {:ok, object}
	e -> {:error, e}
	end
	end

	# Note: will create a Create activity, which we need internally at the moment.
	def fetch_object_from_id(id, options \\ []) do
	with {_, nil} <- {:fetch_object, Object.get_cached_by_ap_id(id)},
	{_, true} <- {:allowed_depth, Federator.allowed_thread_distance?(options[:depth])},
	{_, {:ok, data}} <- {:fetch, fetch_and_contain_remote_object_from_id(id)},
	{_, nil} <- {:normalize, Object.normalize(data, fetch: false)},
	params <- prepare_activity_params(data),
	{_, :ok} <- {:containment, Containment.contain_origin(id, params)},
	{_, {:ok, activity}} <-
	{:transmogrifier, Transmogrifier.handle_incoming(params, options)},
	{_, _data, %Object{} = object} <-
	{:object, data, Object.normalize(activity, fetch: false)} do
	{:ok, object}
	else
	{:allowed_depth, false} = e ->
	log_fetch_error(id, e)
	{:error, "Max thread distance exceeded."}

	{:containment, reason} = e ->
	log_fetch_error(id, e)
	{:error, reason}

	{:transmogrifier, {:error, {:reject, reason}}} = e ->
	log_fetch_error(id, e)
	{:reject, reason}

	{:transmogrifier, {:reject, reason}} = e ->
	log_fetch_error(id, e)
	{:reject, reason}

	{:transmogrifier, reason} = e ->
	log_fetch_error(id, e)
	{:error, reason}

	{:object, data, nil} ->
	reinject_object(%Object{}, data)

	{:normalize, object = %Object{}} ->
	{:ok, object}

	{:fetch_object, %Object{} = object} ->
	{:ok, object}

	{:fetch, {:error, reason}} = e ->
	log_fetch_error(id, e)
	{:error, reason}

	e ->
	log_fetch_error(id, e)
	{:error, e}
	end
	end

	defp log_fetch_error(id, error) do
	Logger.metadata(object: id)
	Logger.error("Object rejected while fetching #{id} #{inspect(error)}")
	end

	defp prepare_activity_params(data) do
	%{
	"type" => "Create",
	# Should we seriously keep this attributedTo thing?
	"actor" => data["actor"] \|\| data["attributedTo"],
	"object" => data
	}
	\|> Maps.put_if_present("to", data["to"])
	\|> Maps.put_if_present("cc", data["cc"])
	\|> Maps.put_if_present("bto", data["bto"])
	\|> Maps.put_if_present("bcc", data["bcc"])
	end

	defp make_signature(id, date) do
	uri = URI.parse(id)

	signature =
	InternalFetchActor.get_actor()
	\|> Signature.sign(%{
	"(request-target)": "get #{uri.path}",
	host: uri.host,
	date: date
	})

	{"signature", signature}
	end

	defp sign_fetch(headers, id, date) do
	if Pleroma.Config.get([:activitypub, :sign_object_fetches]) do
	[make_signature(id, date) \| headers]
	else
	headers
	end
	end

	defp maybe_date_fetch(headers, date) do
	if Pleroma.Config.get([:activitypub, :sign_object_fetches]) do
	[{"date", date} \| headers]
	else
	headers
	end
	end

	def fetch_and_contain_remote_object_from_id(id)

	def fetch_and_contain_remote_object_from_id(%{"id" => id}),
	do: fetch_and_contain_remote_object_from_id(id)

	def fetch_and_contain_remote_object_from_id(id) when is_binary(id) do
	Logger.debug("Fetching object #{id} via AP")

	with {:scheme, true} <- {:scheme, String.starts_with?(id, "http")},
	{:ok, body} <- get_object(id),
	{:ok, data} <- safe_json_decode(body),
	:ok <- Containment.contain_origin_from_id(id, data) do
	if not Instances.reachable?(id) do
	Instances.set_reachable(id)
	end

	{:ok, data}
	else
	{:scheme, _} ->
	{:error, "Unsupported URI scheme"}

	{:error, e} ->
	{:error, e}

	e ->
	{:error, e}
	end
	end

	def fetch_and_contain_remote_object_from_id(_id),
	do: {:error, "id must be a string"}

	defp get_object(id) do
	date = Pleroma.Signature.signed_date()

	headers =
	[{"accept", "application/activity+json"}]
	\|> maybe_date_fetch(date)
	\|> sign_fetch(id, date)

	case HTTP.get(id, headers) do
	{:ok, %{body: body, status: code, headers: headers}} when code in 200..299 ->
	case List.keyfind(headers, "content-type", 0) do
	{_, content_type} ->
	case Plug.Conn.Utils.media_type(content_type) do
	{:ok, "application", "activity+json", _} ->
	{:ok, body}

	{:ok, "application", "ld+json",
	%{"profile" => "https://www.w3.org/ns/activitystreams"}} ->
	{:ok, body}

	_ ->
	{:error, {:content_type, content_type}}
	end

	_ ->
	{:error, {:content_type, nil}}
	end

	{:ok, %{status: 403}} ->
	- {:error, "Object fetch has been denied"}
	+ {:error, :forbidden}

	{:ok, %{status: code}} when code in [404, 410] ->
	- {:error, "Object has been deleted"}
	+ {:error, :not_found}

	{:error, e} ->
	{:error, e}

	e ->
	{:error, e}
	end
	end

	defp safe_json_decode(nil), do: {:ok, nil}
	defp safe_json_decode(json), do: Jason.decode(json)
	end
	diff --git a/lib/pleroma/workers/remote_fetcher_worker.ex b/lib/pleroma/workers/remote_fetcher_worker.ex
	index d4fae33df..dca4530d7 100644
	--- a/lib/pleroma/workers/remote_fetcher_worker.ex
	+++ b/lib/pleroma/workers/remote_fetcher_worker.ex
	@@ -1,34 +1,34 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Workers.RemoteFetcherWorker do
	alias Pleroma.Instances
	alias Pleroma.Object.Fetcher

	use Pleroma.Workers.WorkerHelper, queue: "remote_fetcher"

	@impl Oban.Worker
	def perform(%Job{args: %{"op" => "fetch_remote", "id" => id} = args}) do
	if Instances.reachable?(id) do
	case Fetcher.fetch_object_from_id(id, depth: args["depth"]) do
	{:ok, _object} ->
	:ok

	- {:error, reason = "Object fetch has been denied"} ->
	- {:cancel, reason}
	+ {:error, :forbidden} ->
	+ {:cancel, :forbidden}

	- {:error, reason = "Object has been deleted"} ->
	- {:cancel, reason}
	+ {:error, :not_found} ->
	+ {:cancel, :not_found}

	_ ->
	:error
	end
	else
	{:cancel, "Unreachable instance"}
	end
	end

	@impl Oban.Worker
	def timeout(_job), do: :timer.seconds(10)
	end
	diff --git a/test/pleroma/object/fetcher_test.exs b/test/pleroma/object/fetcher_test.exs
	index 53c9277d6..24f114c00 100644
	--- a/test/pleroma/object/fetcher_test.exs
	+++ b/test/pleroma/object/fetcher_test.exs
	@@ -1,615 +1,615 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Object.FetcherTest do
	use Pleroma.DataCase

	alias Pleroma.Activity
	alias Pleroma.Instances
	alias Pleroma.Object
	alias Pleroma.Object.Fetcher
	alias Pleroma.Web.ActivityPub.ObjectValidator

	require Pleroma.Constants

	import Mock
	import Pleroma.Factory
	import Tesla.Mock

	setup do
	mock(fn
	%{method: :get, url: "https://mastodon.example.org/users/userisgone"} ->
	%Tesla.Env{status: 410}

	%{method: :get, url: "https://mastodon.example.org/users/userisgone404"} ->
	%Tesla.Env{status: 404}

	%{
	method: :get,
	url:
	"https://patch.cx/media/03ca3c8b4ac3ddd08bf0f84be7885f2f88de0f709112131a22d83650819e36c2.json"
	} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/json"}],
	body: File.read!("test/fixtures/spoofed-object.json")
	}

	env ->
	apply(HttpRequestMock, :request, [env])
	end)

	:ok
	end

	describe "error cases" do
	setup do
	mock(fn
	%{method: :get, url: "https://social.sakamoto.gq/notice/9wTkLEnuq47B25EehM"} ->
	%Tesla.Env{
	status: 200,
	body: File.read!("test/fixtures/fetch_mocks/9wTkLEnuq47B25EehM.json"),
	headers: HttpRequestMock.activitypub_object_headers()
	}

	%{method: :get, url: "https://social.sakamoto.gq/users/eal"} ->
	%Tesla.Env{
	status: 200,
	body: File.read!("test/fixtures/fetch_mocks/eal.json"),
	headers: HttpRequestMock.activitypub_object_headers()
	}

	%{method: :get, url: "https://busshi.moe/users/tuxcrafting/statuses/104410921027210069"} ->
	%Tesla.Env{
	status: 200,
	body: File.read!("test/fixtures/fetch_mocks/104410921027210069.json"),
	headers: HttpRequestMock.activitypub_object_headers()
	}

	%{method: :get, url: "https://busshi.moe/users/tuxcrafting"} ->
	%Tesla.Env{
	status: 500
	}

	%{
	method: :get,
	url: "https://stereophonic.space/objects/02997b83-3ea7-4b63-94af-ef3aa2d4ed17"
	} ->
	%Tesla.Env{
	status: 500
	}
	end)

	:ok
	end

	@tag capture_log: true
	test "it works when fetching the OP actor errors out" do
	# Here we simulate a case where the author of the OP can't be read
	assert {:ok, _} =
	Fetcher.fetch_object_from_id(
	"https://social.sakamoto.gq/notice/9wTkLEnuq47B25EehM"
	)
	end
	end

	describe "max thread distance restriction" do
	@ap_id "http://mastodon.example.org/@admin/99541947525187367"
	setup do: clear_config([:instance, :federation_incoming_replies_max_depth])

	test "it returns thread depth exceeded error if thread depth is exceeded" do
	clear_config([:instance, :federation_incoming_replies_max_depth], 0)

	assert {:error, "Max thread distance exceeded."} =
	Fetcher.fetch_object_from_id(@ap_id, depth: 1)
	end

	test "it fetches object if max thread depth is restricted to 0 and depth is not specified" do
	clear_config([:instance, :federation_incoming_replies_max_depth], 0)

	assert {:ok, _} = Fetcher.fetch_object_from_id(@ap_id)
	end

	test "it fetches object if requested depth does not exceed max thread depth" do
	clear_config([:instance, :federation_incoming_replies_max_depth], 10)

	assert {:ok, _} = Fetcher.fetch_object_from_id(@ap_id, depth: 10)
	end
	end

	describe "actor origin containment" do
	test "it rejects objects with a bogus origin" do
	{:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity.json")
	end

	test "it rejects objects when attributedTo is wrong (variant 1)" do
	{:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity2.json")
	end

	test "it rejects objects when attributedTo is wrong (variant 2)" do
	{:error, _} = Fetcher.fetch_object_from_id("https://info.pleroma.site/activity3.json")
	end
	end

	describe "fetching an object" do
	test "it fetches an object" do
	{:ok, object} =
	Fetcher.fetch_object_from_id("http://mastodon.example.org/@admin/99541947525187367")

	assert _activity = Activity.get_create_by_object_ap_id(object.data["id"])

	{:ok, object_again} =
	Fetcher.fetch_object_from_id("http://mastodon.example.org/@admin/99541947525187367")

	assert [attachment] = object.data["attachment"]
	assert is_list(attachment["url"])

	assert object == object_again
	end

	test "Return MRF reason when fetched status is rejected by one" do
	clear_config([:mrf_keyword, :reject], ["yeah"])
	clear_config([:mrf, :policies], [Pleroma.Web.ActivityPub.MRF.KeywordPolicy])

	assert {:reject, "[KeywordPolicy] Matches with rejected keyword"} ==
	Fetcher.fetch_object_from_id(
	"http://mastodon.example.org/@admin/99541947525187367"
	)
	end

	test "it does not fetch a spoofed object uploaded on an instance as an attachment" do
	assert {:error, _} =
	Fetcher.fetch_object_from_id(
	"https://patch.cx/media/03ca3c8b4ac3ddd08bf0f84be7885f2f88de0f709112131a22d83650819e36c2.json"
	)
	end

	test "it resets instance reachability on successful fetch" do
	id = "http://mastodon.example.org/@admin/99541947525187367"
	Instances.set_consistently_unreachable(id)
	refute Instances.reachable?(id)

	{:ok, _object} =
	Fetcher.fetch_object_from_id("http://mastodon.example.org/@admin/99541947525187367")

	assert Instances.reachable?(id)
	end
	end

	describe "implementation quirks" do
	test "it can fetch plume articles" do
	{:ok, object} =
	Fetcher.fetch_object_from_id(
	"https://baptiste.gelez.xyz/~/PlumeDevelopment/this-month-in-plume-june-2018/"
	)

	assert object
	end

	test "it can fetch peertube videos" do
	{:ok, object} =
	Fetcher.fetch_object_from_id(
	"https://peertube.moe/videos/watch/df5f464b-be8d-46fb-ad81-2d4c2d1630e3"
	)

	assert object
	end

	test "it can fetch Mobilizon events" do
	{:ok, object} =
	Fetcher.fetch_object_from_id(
	"https://mobilizon.org/events/252d5816-00a3-4a89-a66f-15bf65c33e39"
	)

	assert object
	end

	test "it can fetch wedistribute articles" do
	{:ok, object} =
	Fetcher.fetch_object_from_id("https://wedistribute.org/wp-json/pterotype/v1/object/85810")

	assert object
	end

	test "all objects with fake directions are rejected by the object fetcher" do
	assert {:error, _} =
	Fetcher.fetch_and_contain_remote_object_from_id(
	"https://info.pleroma.site/activity4.json"
	)
	end

	test "handle HTTP 410 Gone response" do
	- assert {:error, "Object has been deleted"} ==
	+ assert {:error, :not_found} ==
	Fetcher.fetch_and_contain_remote_object_from_id(
	"https://mastodon.example.org/users/userisgone"
	)
	end

	test "handle HTTP 404 response" do
	- assert {:error, "Object has been deleted"} ==
	+ assert {:error, :not_found} ==
	Fetcher.fetch_and_contain_remote_object_from_id(
	"https://mastodon.example.org/users/userisgone404"
	)
	end

	test "it can fetch pleroma polls with attachments" do
	{:ok, object} =
	Fetcher.fetch_object_from_id("https://patch.cx/objects/tesla_mock/poll_attachment")

	assert object
	end
	end

	describe "pruning" do
	test "it can refetch pruned objects" do
	object_id = "http://mastodon.example.org/@admin/99541947525187367"

	{:ok, object} = Fetcher.fetch_object_from_id(object_id)

	assert object

	{:ok, _object} = Object.prune(object)

	refute Object.get_by_ap_id(object_id)

	{:ok, %Object{} = object_two} = Fetcher.fetch_object_from_id(object_id)

	assert object.data["id"] == object_two.data["id"]
	assert object.id != object_two.id
	end
	end

	describe "signed fetches" do
	setup do: clear_config([:activitypub, :sign_object_fetches])

	test_with_mock "it signs fetches when configured to do so",
	Pleroma.Signature,
	[:passthrough],
	[] do
	clear_config([:activitypub, :sign_object_fetches], true)

	Fetcher.fetch_object_from_id("http://mastodon.example.org/@admin/99541947525187367")

	assert called(Pleroma.Signature.sign(:_, :_))
	end

	test_with_mock "it doesn't sign fetches when not configured to do so",
	Pleroma.Signature,
	[:passthrough],
	[] do
	clear_config([:activitypub, :sign_object_fetches], false)

	Fetcher.fetch_object_from_id("http://mastodon.example.org/@admin/99541947525187367")

	refute called(Pleroma.Signature.sign(:_, :_))
	end
	end

	describe "refetching" do
	setup do
	insert(:user, ap_id: "https://mastodon.social/users/emelie")

	object1 = %{
	"id" => "https://mastodon.social/1",
	"actor" => "https://mastodon.social/users/emelie",
	"attributedTo" => "https://mastodon.social/users/emelie",
	"type" => "Note",
	"content" => "test 1",
	"bcc" => [],
	"bto" => [],
	"cc" => [],
	"to" => [Pleroma.Constants.as_public()],
	"summary" => "",
	"published" => "2023-05-08 23:43:20Z",
	"updated" => "2023-05-09 23:43:20Z"
	}

	{:ok, local_object1, _} = ObjectValidator.validate(object1, [])

	object2 = %{
	"id" => "https://mastodon.social/2",
	"actor" => "https://mastodon.social/users/emelie",
	"attributedTo" => "https://mastodon.social/users/emelie",
	"type" => "Note",
	"content" => "test 2",
	"bcc" => [],
	"bto" => [],
	"cc" => [],
	"to" => [Pleroma.Constants.as_public()],
	"summary" => "",
	"published" => "2023-05-08 23:43:20Z",
	"updated" => "2023-05-09 23:43:25Z",
	"formerRepresentations" => %{
	"type" => "OrderedCollection",
	"orderedItems" => [
	%{
	"type" => "Note",
	"content" => "orig 2",
	"actor" => "https://mastodon.social/users/emelie",
	"attributedTo" => "https://mastodon.social/users/emelie",
	"bcc" => [],
	"bto" => [],
	"cc" => [],
	"to" => [Pleroma.Constants.as_public()],
	"summary" => "",
	"published" => "2023-05-08 23:43:20Z",
	"updated" => "2023-05-09 23:43:21Z"
	}
	],
	"totalItems" => 1
	}
	}

	{:ok, local_object2, _} = ObjectValidator.validate(object2, [])

	mock(fn
	%{
	method: :get,
	url: "https://mastodon.social/1"
	} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/activity+json"}],
	body: Jason.encode!(object1 \|> Map.put("updated", "2023-05-09 23:44:20Z"))
	}

	%{
	method: :get,
	url: "https://mastodon.social/2"
	} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/activity+json"}],
	body: Jason.encode!(object2 \|> Map.put("updated", "2023-05-09 23:44:20Z"))
	}

	%{
	method: :get,
	url: "https://mastodon.social/users/emelie/collections/featured"
	} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/activity+json"}],
	body:
	Jason.encode!(%{
	"id" => "https://mastodon.social/users/emelie/collections/featured",
	"type" => "OrderedCollection",
	"actor" => "https://mastodon.social/users/emelie",
	"attributedTo" => "https://mastodon.social/users/emelie",
	"orderedItems" => [],
	"totalItems" => 0
	})
	}

	env ->
	apply(HttpRequestMock, :request, [env])
	end)

	%{object1: local_object1, object2: local_object2}
	end

	test "it keeps formerRepresentations if remote does not have this attr", %{object1: object1} do
	full_object1 =
	object1
	\|> Map.merge(%{
	"formerRepresentations" => %{
	"type" => "OrderedCollection",
	"orderedItems" => [
	%{
	"type" => "Note",
	"content" => "orig 2",
	"actor" => "https://mastodon.social/users/emelie",
	"attributedTo" => "https://mastodon.social/users/emelie",
	"bcc" => [],
	"bto" => [],
	"cc" => [],
	"to" => [Pleroma.Constants.as_public()],
	"summary" => "",
	"published" => "2023-05-08 23:43:20Z"
	}
	],
	"totalItems" => 1
	}
	})

	{:ok, o} = Object.create(full_object1)

	assert {:ok, refetched} = Fetcher.refetch_object(o)

	assert %{"formerRepresentations" => %{"orderedItems" => [%{"content" => "orig 2"}]}} =
	refetched.data
	end

	test "it uses formerRepresentations from remote if possible", %{object2: object2} do
	{:ok, o} = Object.create(object2)

	assert {:ok, refetched} = Fetcher.refetch_object(o)

	assert %{"formerRepresentations" => %{"orderedItems" => [%{"content" => "orig 2"}]}} =
	refetched.data
	end

	test "it replaces formerRepresentations with the one from remote", %{object2: object2} do
	full_object2 =
	object2
	\|> Map.merge(%{
	"content" => "mew mew #def",
	"formerRepresentations" => %{
	"type" => "OrderedCollection",
	"orderedItems" => [
	%{"type" => "Note", "content" => "mew mew 2"}
	],
	"totalItems" => 1
	}
	})

	{:ok, o} = Object.create(full_object2)

	assert {:ok, refetched} = Fetcher.refetch_object(o)

	assert %{
	"content" => "test 2",
	"formerRepresentations" => %{"orderedItems" => [%{"content" => "orig 2"}]}
	} = refetched.data
	end

	test "it adds to formerRepresentations if the remote does not have one and the object has changed",
	%{object1: object1} do
	full_object1 =
	object1
	\|> Map.merge(%{
	"content" => "mew mew #def",
	"formerRepresentations" => %{
	"type" => "OrderedCollection",
	"orderedItems" => [
	%{"type" => "Note", "content" => "mew mew 1"}
	],
	"totalItems" => 1
	}
	})

	{:ok, o} = Object.create(full_object1)

	assert {:ok, refetched} = Fetcher.refetch_object(o)

	assert %{
	"content" => "test 1",
	"formerRepresentations" => %{
	"orderedItems" => [
	%{"content" => "mew mew #def"},
	%{"content" => "mew mew 1"}
	],
	"totalItems" => 2
	}
	} = refetched.data
	end

	test "it keeps the history intact if only updated time has changed",
	%{object1: object1} do
	full_object1 =
	object1
	\|> Map.merge(%{
	"updated" => "2023-05-08 23:43:47Z",
	"formerRepresentations" => %{
	"type" => "OrderedCollection",
	"orderedItems" => [
	%{"type" => "Note", "content" => "mew mew 1"}
	],
	"totalItems" => 1
	}
	})

	{:ok, o} = Object.create(full_object1)

	assert {:ok, refetched} = Fetcher.refetch_object(o)

	assert %{
	"content" => "test 1",
	"formerRepresentations" => %{
	"orderedItems" => [
	%{"content" => "mew mew 1"}
	],
	"totalItems" => 1
	}
	} = refetched.data
	end

	test "it goes through ObjectValidator and MRF", %{object2: object2} do
	with_mock Pleroma.Web.ActivityPub.MRF, [:passthrough],
	filter: fn
	%{"type" => "Note"} = object ->
	{:ok, Map.put(object, "content", "MRFd content")}

	arg ->
	passthrough([arg])
	end do
	{:ok, o} = Object.create(object2)

	assert {:ok, refetched} = Fetcher.refetch_object(o)

	assert %{"content" => "MRFd content"} = refetched.data
	end
	end
	end

	describe "fetch with history" do
	setup do
	object2 = %{
	"id" => "https://mastodon.social/2",
	"actor" => "https://mastodon.social/users/emelie",
	"attributedTo" => "https://mastodon.social/users/emelie",
	"type" => "Note",
	"content" => "test 2",
	"bcc" => [],
	"bto" => [],
	"cc" => ["https://mastodon.social/users/emelie/followers"],
	"to" => [],
	"summary" => "",
	"formerRepresentations" => %{
	"type" => "OrderedCollection",
	"orderedItems" => [
	%{
	"type" => "Note",
	"content" => "orig 2",
	"actor" => "https://mastodon.social/users/emelie",
	"attributedTo" => "https://mastodon.social/users/emelie",
	"bcc" => [],
	"bto" => [],
	"cc" => ["https://mastodon.social/users/emelie/followers"],
	"to" => [],
	"summary" => ""
	}
	],
	"totalItems" => 1
	}
	}

	mock(fn
	%{
	method: :get,
	url: "https://mastodon.social/2"
	} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/activity+json"}],
	body: Jason.encode!(object2)
	}

	%{
	method: :get,
	url: "https://mastodon.social/users/emelie/collections/featured"
	} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/activity+json"}],
	body:
	Jason.encode!(%{
	"id" => "https://mastodon.social/users/emelie/collections/featured",
	"type" => "OrderedCollection",
	"actor" => "https://mastodon.social/users/emelie",
	"attributedTo" => "https://mastodon.social/users/emelie",
	"orderedItems" => [],
	"totalItems" => 0
	})
	}

	env ->
	apply(HttpRequestMock, :request, [env])
	end)

	%{object2: object2}
	end

	test "it gets history", %{object2: object2} do
	{:ok, object} = Fetcher.fetch_object_from_id(object2["id"])

	assert %{
	"formerRepresentations" => %{
	"type" => "OrderedCollection",
	"orderedItems" => [%{}]
	}
	} = object.data
	end
	end
	end
	diff --git a/test/pleroma/web/twitter_api/remote_follow_controller_test.exs b/test/pleroma/web/twitter_api/remote_follow_controller_test.exs
	index 41f8ebcd7..c6ecb53f4 100644
	--- a/test/pleroma/web/twitter_api/remote_follow_controller_test.exs
	+++ b/test/pleroma/web/twitter_api/remote_follow_controller_test.exs
	@@ -1,497 +1,497 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.TwitterAPI.RemoteFollowControllerTest do
	use Pleroma.Web.ConnCase

	alias Pleroma.MFA
	alias Pleroma.MFA.TOTP
	alias Pleroma.UnstubbedConfigMock, as: ConfigMock
	alias Pleroma.User
	alias Pleroma.Web.CommonAPI

	import Ecto.Query
	import ExUnit.CaptureLog
	import Mox
	import Pleroma.Factory

	setup_all do: clear_config([:instance, :federating], true)
	setup do: clear_config([:user, :deny_follow_blocked])

	describe "GET /ostatus_subscribe - remote_follow/2" do
	test "adds status to pleroma instance if the `acct` is a status", %{conn: conn} do
	Tesla.Mock.mock(fn
	%{method: :get, url: "https://mastodon.social/users/emelie/statuses/101849165031453009"} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/activity+json"}],
	body: File.read!("test/fixtures/tesla_mock/status.emelie.json")
	}

	%{method: :get, url: "https://mastodon.social/users/emelie/collections/featured"} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/activity+json"}],
	body:
	File.read!("test/fixtures/users_mock/masto_featured.json")
	\|> String.replace("{{domain}}", "mastodon.social")
	\|> String.replace("{{nickname}}", "emelie")
	}

	%{method: :get, url: "https://mastodon.social/users/emelie"} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/activity+json"}],
	body: File.read!("test/fixtures/tesla_mock/emelie.json")
	}
	end)

	assert conn
	\|> get(
	remote_follow_path(conn, :follow, %{
	acct: "https://mastodon.social/users/emelie/statuses/101849165031453009"
	})
	)
	\|> redirected_to() =~ "/notice/"
	end

	test "show follow account page if the `acct` is a account link", %{conn: conn} do
	Tesla.Mock.mock(fn
	%{method: :get, url: "https://mastodon.social/users/emelie"} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/activity+json"}],
	body: File.read!("test/fixtures/tesla_mock/emelie.json")
	}

	%{method: :get, url: "https://mastodon.social/users/emelie/collections/featured"} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/activity+json"}],
	body:
	File.read!("test/fixtures/users_mock/masto_featured.json")
	\|> String.replace("{{domain}}", "mastodon.social")
	\|> String.replace("{{nickname}}", "emelie")
	}
	end)

	response =
	conn
	\|> get(remote_follow_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"}))
	\|> html_response(200)

	assert response =~ "Log in to follow"
	end

	test "show follow page if the `acct` is a account link", %{conn: conn} do
	Tesla.Mock.mock(fn
	%{method: :get, url: "https://mastodon.social/users/emelie"} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/activity+json"}],
	body: File.read!("test/fixtures/tesla_mock/emelie.json")
	}

	%{method: :get, url: "https://mastodon.social/users/emelie/collections/featured"} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/activity+json"}],
	body:
	File.read!("test/fixtures/users_mock/masto_featured.json")
	\|> String.replace("{{domain}}", "mastodon.social")
	\|> String.replace("{{nickname}}", "emelie")
	}
	end)

	user = insert(:user)

	response =
	conn
	\|> assign(:user, user)
	\|> get(remote_follow_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"}))
	\|> html_response(200)

	assert response =~ "Remote follow"
	end

	test "show follow page with error when user can not be fetched by `acct` link", %{conn: conn} do
	Tesla.Mock.mock(fn
	%{method: :get, url: "https://mastodon.social/users/not_found"} ->
	%Tesla.Env{
	status: 404
	}
	end)

	user = insert(:user)

	assert capture_log(fn ->
	response =
	conn
	\|> assign(:user, user)
	\|> get(
	remote_follow_path(conn, :follow, %{
	acct: "https://mastodon.social/users/not_found"
	})
	)
	\|> html_response(200)

	assert response =~ "Error fetching user"
	- end) =~ "Object has been deleted"
	+ end) =~ ":not_found"
	end
	end

	describe "POST /ostatus_subscribe - do_follow/2 with assigned user " do
	test "required `follow \| write:follows` scope", %{conn: conn} do
	user = insert(:user)
	user2 = insert(:user)
	read_token = insert(:oauth_token, user: user, scopes: ["read"])

	assert capture_log(fn ->
	response =
	conn
	\|> assign(:user, user)
	\|> assign(:token, read_token)
	\|> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
	\|> response(200)

	assert response =~ "Error following account"
	end) =~ "Insufficient permissions: follow \| write:follows."
	end

	test "follows user", %{conn: conn} do
	user = insert(:user)
	user2 = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> assign(:token, insert(:oauth_token, user: user, scopes: ["write:follows"]))
	\|> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})

	assert redirected_to(conn) == "/users/#{user2.id}"
	end

	test "returns error when user is deactivated", %{conn: conn} do
	user = insert(:user, is_active: false)
	user2 = insert(:user)

	response =
	conn
	\|> assign(:user, user)
	\|> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
	\|> response(200)

	assert response =~ "Error following account"
	end

	test "returns error when user is blocked", %{conn: conn} do
	clear_config([:user, :deny_follow_blocked], true)
	user = insert(:user)
	user2 = insert(:user)

	{:ok, _user_block} = Pleroma.User.block(user2, user)

	response =
	conn
	\|> assign(:user, user)
	\|> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
	\|> response(200)

	assert response =~ "Error following account"
	end

	test "returns error when followee not found", %{conn: conn} do
	user = insert(:user)

	response =
	conn
	\|> assign(:user, user)
	\|> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => "jimm"}})
	\|> response(200)

	assert response =~ "Error following account"
	end

	test "returns success result when user already in followers", %{conn: conn} do
	user = insert(:user)
	user2 = insert(:user)
	{:ok, _, _, _} = CommonAPI.follow(user, user2)

	conn =
	conn
	\|> assign(:user, refresh_record(user))
	\|> assign(:token, insert(:oauth_token, user: user, scopes: ["write:follows"]))
	\|> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})

	assert redirected_to(conn) == "/users/#{user2.id}"
	end
	end

	describe "POST /ostatus_subscribe - follow/2 with enabled Two-Factor Auth " do
	test "render the MFA login form", %{conn: conn} do
	otp_secret = TOTP.generate_secret()

	user =
	insert(:user,
	multi_factor_authentication_settings: %MFA.Settings{
	enabled: true,
	totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
	}
	)

	user2 = insert(:user)

	response =
	conn
	\|> post(remote_follow_path(conn, :do_follow), %{
	"authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
	})
	\|> response(200)

	mfa_token = Pleroma.Repo.one(from(q in Pleroma.MFA.Token, where: q.user_id == ^user.id))

	assert response =~ "Two-factor authentication"
	assert response =~ "Authentication code"
	assert response =~ mfa_token.token
	refute user2.follower_address in User.following(user)
	end

	test "returns error when password is incorrect", %{conn: conn} do
	otp_secret = TOTP.generate_secret()

	user =
	insert(:user,
	multi_factor_authentication_settings: %MFA.Settings{
	enabled: true,
	totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
	}
	)

	user2 = insert(:user)

	response =
	conn
	\|> post(remote_follow_path(conn, :do_follow), %{
	"authorization" => %{"name" => user.nickname, "password" => "test1", "id" => user2.id}
	})
	\|> response(200)

	assert response =~ "Wrong username or password"
	refute user2.follower_address in User.following(user)
	end

	test "follows", %{conn: conn} do
	otp_secret = TOTP.generate_secret()

	user =
	insert(:user,
	multi_factor_authentication_settings: %MFA.Settings{
	enabled: true,
	totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
	}
	)

	{:ok, %{token: token}} = MFA.Token.create(user)

	user2 = insert(:user)
	otp_token = TOTP.generate_token(otp_secret)

	conn =
	conn
	\|> post(
	remote_follow_path(conn, :do_follow),
	%{
	"mfa" => %{"code" => otp_token, "token" => token, "id" => user2.id}
	}
	)

	assert redirected_to(conn) == "/users/#{user2.id}"
	assert user2.follower_address in User.following(user)
	end

	test "returns error when auth code is incorrect", %{conn: conn} do
	otp_secret = TOTP.generate_secret()

	user =
	insert(:user,
	multi_factor_authentication_settings: %MFA.Settings{
	enabled: true,
	totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
	}
	)

	{:ok, %{token: token}} = MFA.Token.create(user)

	user2 = insert(:user)
	otp_token = TOTP.generate_token(TOTP.generate_secret())

	response =
	conn
	\|> post(
	remote_follow_path(conn, :do_follow),
	%{
	"mfa" => %{"code" => otp_token, "token" => token, "id" => user2.id}
	}
	)
	\|> response(200)

	assert response =~ "Wrong authentication code"
	refute user2.follower_address in User.following(user)
	end
	end

	describe "POST /ostatus_subscribe - follow/2 without assigned user " do
	test "follows", %{conn: conn} do
	user = insert(:user)
	user2 = insert(:user)

	conn =
	conn
	\|> post(remote_follow_path(conn, :do_follow), %{
	"authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
	})

	assert redirected_to(conn) == "/users/#{user2.id}"
	assert user2.follower_address in User.following(user)
	end

	test "returns error when followee not found", %{conn: conn} do
	user = insert(:user)

	response =
	conn
	\|> post(remote_follow_path(conn, :do_follow), %{
	"authorization" => %{"name" => user.nickname, "password" => "test", "id" => "jimm"}
	})
	\|> response(200)

	assert response =~ "Error following account"
	end

	test "returns error when login invalid", %{conn: conn} do
	user = insert(:user)

	response =
	conn
	\|> post(remote_follow_path(conn, :do_follow), %{
	"authorization" => %{"name" => "jimm", "password" => "test", "id" => user.id}
	})
	\|> response(200)

	assert response =~ "Wrong username or password"
	end

	test "returns error when password invalid", %{conn: conn} do
	user = insert(:user)
	user2 = insert(:user)

	response =
	conn
	\|> post(remote_follow_path(conn, :do_follow), %{
	"authorization" => %{"name" => user.nickname, "password" => "42", "id" => user2.id}
	})
	\|> response(200)

	assert response =~ "Wrong username or password"
	end

	test "returns error when user is blocked", %{conn: conn} do
	clear_config([:user, :deny_follow_blocked], true)
	user = insert(:user)
	user2 = insert(:user)
	{:ok, _user_block} = Pleroma.User.block(user2, user)

	response =
	conn
	\|> post(remote_follow_path(conn, :do_follow), %{
	"authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
	})
	\|> response(200)

	assert response =~ "Error following account"
	end
	end

	describe "avatar url" do
	test "without media proxy" do
	clear_config([:media_proxy, :enabled], false)

	user =
	insert(:user, %{
	local: false,
	avatar: %{"url" => [%{"href" => "https://remote.org/avatar.png"}]}
	})

	avatar_url = Pleroma.Web.TwitterAPI.RemoteFollowView.avatar_url(user)

	assert avatar_url == "https://remote.org/avatar.png"
	end

	test "with media proxy" do
	clear_config([:media_proxy, :enabled], true)

	ConfigMock
	\|> stub_with(Pleroma.Test.StaticConfig)

	user =
	insert(:user, %{
	local: false,
	avatar: %{"url" => [%{"href" => "https://remote.org/avatar.png"}]}
	})

	avatar_url = Pleroma.Web.TwitterAPI.RemoteFollowView.avatar_url(user)
	url = Pleroma.Web.Endpoint.url()

	assert String.starts_with?(avatar_url, url)
	end

	test "local avatar is not proxied" do
	clear_config([:media_proxy, :enabled], true)

	user =
	insert(:user, %{
	local: true,
	avatar: %{"url" => [%{"href" => "#{Pleroma.Web.Endpoint.url()}/localuser/avatar.png"}]}
	})

	avatar_url = Pleroma.Web.TwitterAPI.RemoteFollowView.avatar_url(user)

	assert avatar_url == "#{Pleroma.Web.Endpoint.url()}/localuser/avatar.png"
	end
	end

	describe "GET /authorize_interaction - authorize_interaction/2" do
	test "redirects to /ostatus_subscribe", %{conn: conn} do
	Tesla.Mock.mock(fn
	%{method: :get, url: "https://mastodon.social/users/emelie"} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/activity+json"}],
	body: File.read!("test/fixtures/tesla_mock/emelie.json")
	}

	%{method: :get, url: "https://mastodon.social/users/emelie/collections/featured"} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/activity+json"}],
	body:
	File.read!("test/fixtures/users_mock/masto_featured.json")
	\|> String.replace("{{domain}}", "mastodon.social")
	\|> String.replace("{{nickname}}", "emelie")
	}
	end)

	conn =
	conn
	\|> get(
	remote_follow_path(conn, :authorize_interaction, %{
	uri: "https://mastodon.social/users/emelie"
	})
	)

	assert redirected_to(conn) ==
	remote_follow_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"})
	end
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Thu, Oct 29, 2:50 AM (5 h, 14 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1797440
Default Alt Text: (44 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions