No OneTemporary
Actions

Authored By

Unknown

Size

40 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/lib/pleroma/web.ex b/lib/pleroma/web.ex
	index bf7fa86a3..70e7f6458 100644
	--- a/lib/pleroma/web.ex
	+++ b/lib/pleroma/web.ex
	@@ -1,236 +1,245 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web do
	@moduledoc """
	A module that keeps using definitions for controllers,
	views and so on.

	This can be used in your application as:

	use Pleroma.Web, :controller
	use Pleroma.Web, :view

	The definitions below will be executed for every view,
	controller, etc, so keep them short and clean, focused
	on imports, uses and aliases.

	Do NOT define functions inside the quoted expressions
	below.
	"""

	alias Pleroma.Helpers.AuthHelper
	alias Pleroma.Web.Plugs.EnsureAuthenticatedPlug
	alias Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug
	alias Pleroma.Web.Plugs.ExpectAuthenticatedCheckPlug
	alias Pleroma.Web.Plugs.ExpectPublicOrAuthenticatedCheckPlug
	alias Pleroma.Web.Plugs.OAuthScopesPlug
	alias Pleroma.Web.Plugs.PlugHelper

	def controller do
	quote do
	use Phoenix.Controller, formats: [json: "View", html: "View"]

	import Plug.Conn

	import Pleroma.Web.Gettext
	import Pleroma.Web.TranslationHelpers

	alias Pleroma.Web.Router.Helpers, as: Routes

	+ plug(:set_put_layout)
	+
	+ defp set_put_layout(conn, _) do
	+ case Pleroma.Config.get(:app_layout, "app.html") do
	+ false -> put_layout(conn, false)
	+ layout -> put_layout(conn, {Pleroma.Web.LayoutView, layout})
	+ end
	+ end
	+
	# Marks plugs intentionally skipped and blocks their execution if present in plugs chain
	defp skip_plug(conn, plug_modules) do
	plug_modules
	\|> List.wrap()
	\|> Enum.reduce(
	conn,
	fn plug_module, conn ->
	try do
	plug_module.skip_plug(conn)
	rescue
	UndefinedFunctionError ->
	raise "`#{plug_module}` is not skippable. Append `use Pleroma.Web, :plug` to its code."
	end
	end
	)
	end

	defp skip_auth(conn, _) do
	skip_plug(conn, [OAuthScopesPlug, EnsurePublicOrAuthenticatedPlug])
	end

	defp skip_public_check(conn, _) do
	skip_plug(conn, EnsurePublicOrAuthenticatedPlug)
	end

	# Executed just before actual controller action, invokes before-action hooks (callbacks)
	defp action(conn, params) do
	with %{halted: false} = conn <-
	maybe_drop_authentication_if_oauth_check_ignored(conn),
	%{halted: false} = conn <- maybe_perform_public_or_authenticated_check(conn),
	%{halted: false} = conn <- maybe_perform_authenticated_check(conn),
	%{halted: false} = conn <- maybe_halt_on_missing_oauth_scopes_check(conn) do
	super(conn, params)
	end
	end

	# For non-authenticated API actions, drops auth info if OAuth scopes check was ignored
	# (neither performed nor explicitly skipped)
	defp maybe_drop_authentication_if_oauth_check_ignored(conn) do
	if PlugHelper.plug_called?(conn, ExpectPublicOrAuthenticatedCheckPlug) and
	not PlugHelper.plug_called_or_skipped?(conn, OAuthScopesPlug) do
	AuthHelper.drop_auth_info(conn)
	else
	conn
	end
	end

	# Ensures instance is public -or- user is authenticated if such check was scheduled
	defp maybe_perform_public_or_authenticated_check(conn) do
	if PlugHelper.plug_called?(conn, ExpectPublicOrAuthenticatedCheckPlug) do
	EnsurePublicOrAuthenticatedPlug.call(conn, %{})
	else
	conn
	end
	end

	# Ensures user is authenticated if such check was scheduled
	# Note: runs prior to action even if it was already executed earlier in plug chain
	# (since OAuthScopesPlug has option of proceeding unauthenticated)
	defp maybe_perform_authenticated_check(conn) do
	if PlugHelper.plug_called?(conn, ExpectAuthenticatedCheckPlug) do
	EnsureAuthenticatedPlug.call(conn, %{})
	else
	conn
	end
	end

	# Halts if authenticated API action neither performs nor explicitly skips OAuth scopes check
	defp maybe_halt_on_missing_oauth_scopes_check(conn) do
	if PlugHelper.plug_called?(conn, ExpectAuthenticatedCheckPlug) and
	not PlugHelper.plug_called_or_skipped?(conn, OAuthScopesPlug) do
	conn
	\|> render_error(
	:forbidden,
	"Security violation: OAuth scopes check was neither handled nor explicitly skipped."
	)
	\|> halt()
	else
	conn
	end
	end
	end
	end

	def view do
	quote do
	use Phoenix.View,
	root: "lib/pleroma/web/templates",
	namespace: Pleroma.Web

	# Import convenience functions from controllers
	import Phoenix.Controller, only: [get_csrf_token: 0, view_module: 1]

	import Pleroma.Web.ErrorHelpers
	import Pleroma.Web.Gettext

	alias Pleroma.Web.Router.Helpers, as: Routes

	require Logger

	@doc "Same as `render/3` but wrapped in a rescue block"
	def safe_render(view, template, assigns \\ %{}) do
	Phoenix.View.render(view, template, assigns)
	rescue
	error ->
	Logger.error(
	"#{__MODULE__} failed to render #{inspect({view, template})}\n" <>
	Exception.format(:error, error, __STACKTRACE__)
	)

	nil
	end

	@doc """
	Same as `render_many/4` but wrapped in rescue block.
	"""
	def safe_render_many(collection, view, template, assigns \\ %{}) do
	Enum.map(collection, fn resource ->
	as = Map.get(assigns, :as) \|\| view.__resource__()
	assigns = Map.put(assigns, as, resource)
	safe_render(view, template, assigns)
	end)
	\|> Enum.filter(& &1)
	end
	end
	end

	def router do
	quote do
	use Phoenix.Router
	# credo:disable-for-next-line Credo.Check.Consistency.MultiAliasImportRequireUse
	import Plug.Conn
	import Phoenix.Controller
	end
	end

	def channel do
	quote do
	# credo:disable-for-next-line Credo.Check.Consistency.MultiAliasImportRequireUse
	import Phoenix.Channel
	import Pleroma.Web.Gettext
	end
	end

	def plug do
	quote do
	@behaviour Pleroma.Web.Plug
	@behaviour Plug

	@doc """
	Marks a plug intentionally skipped and blocks its execution if it's present in plugs chain.
	"""
	def skip_plug(conn) do
	PlugHelper.append_to_private_list(
	conn,
	PlugHelper.skipped_plugs_list_id(),
	__MODULE__
	)
	end

	@impl Plug
	@doc """
	Before-plug hook that
	* ensures the plug is not skipped
	* processes `:if_func` / `:unless_func` functional pre-run conditions
	* adds plug to the list of called plugs and calls `perform/2` if checks are passed

	Note: multiple invocations of the same plug (with different or same options) are allowed.
	"""
	def call(%Plug.Conn{} = conn, options) do
	if PlugHelper.plug_skipped?(conn, __MODULE__) \|\|
	(options[:if_func] && !options[:if_func].(conn)) \|\|
	(options[:unless_func] && options[:unless_func].(conn)) do
	conn
	else
	conn =
	PlugHelper.append_to_private_list(
	conn,
	PlugHelper.called_plugs_list_id(),
	__MODULE__
	)

	apply(__MODULE__, :perform, [conn, options])
	end
	end
	end
	end

	@doc """
	When used, dispatch to the appropriate controller/view/etc.
	"""
	defmacro __using__(which) when is_atom(which) do
	apply(__MODULE__, which, [])
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/websocket_handler.ex b/lib/pleroma/web/mastodon_api/websocket_handler.ex
	index 616f35912..2b698bd5d 100644
	--- a/lib/pleroma/web/mastodon_api/websocket_handler.ex
	+++ b/lib/pleroma/web/mastodon_api/websocket_handler.ex
	@@ -1,258 +1,264 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.WebsocketHandler do
	require Logger

	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.OAuth.Token
	alias Pleroma.Web.Streamer
	alias Pleroma.Web.StreamerView

	@behaviour Phoenix.Socket.Transport

	# Client ping period.
	@tick :timer.seconds(30)

	@impl Phoenix.Socket.Transport
	def child_spec(_opts), do: :ignore

	# This only prepares the connection and is not in the process yet
	@impl Phoenix.Socket.Transport
	def connect(%{params: params} = transport_info) do
	with access_token <- find_access_token(transport_info),
	{:ok, user, oauth_token} <- authenticate_request(access_token),
	{:ok, topic} <-
	Streamer.get_topic(params["stream"], user, oauth_token, params) do
	topics =
	if topic do
	[topic]
	else
	[]
	end

	state = %{
	user: user,
	topics: topics,
	oauth_token: oauth_token,
	count: 0,
	timer: nil
	}

	{:ok, state}
	else
	{:error, :bad_topic} ->
	Logger.debug("#{__MODULE__} bad topic #{inspect(transport_info)}")

	{:error, :bad_topic}

	{:error, :unauthorized} ->
	Logger.debug("#{__MODULE__} authentication error: #{inspect(transport_info)}")
	{:error, :unauthorized}
	end
	end

	# All subscriptions/links and messages cannot be created
	# until the processed is launched with init/1
	@impl Phoenix.Socket.Transport
	def init(state) do
	Enum.each(state.topics, fn topic -> Streamer.add_socket(topic, state.oauth_token) end)

	Process.send_after(self(), :ping, @tick)

	{:ok, state}
	end

	@impl Phoenix.Socket.Transport
	def handle_in({text, [opcode: :text]}, state) do
	with {:ok, %{} = event} <- Jason.decode(text) do
	handle_client_event(event, state)
	else
	_ ->
	Logger.error("#{__MODULE__} received non-JSON event: #{inspect(text)}")
	{:ok, state}
	end
	end

	def handle_in(frame, state) do
	Logger.error("#{__MODULE__} received frame: #{inspect(frame)}")
	{:ok, state}
	end

	@impl Phoenix.Socket.Transport
	def handle_info({:render_with_user, view, template, item, topic}, state) do
	user = %User{} = User.get_cached_by_ap_id(state.user.ap_id)

	unless Streamer.filtered_by_user?(user, item) do
	message = view.render(template, item, user, topic)
	{:push, {:text, message}, %{state \| user: user}}
	else
	{:ok, state}
	end
	end

	def handle_info({:text, text}, state) do
	{:push, {:text, text}, state}
	end

	def handle_info(:ping, state) do
	Process.send_after(self(), :ping, @tick)

	{:push, {:ping, ""}, state}
	end

	def handle_info(:close, state) do
	{:stop, {:closed, ~c"connection closed by server"}, state}
	end

	def handle_info(msg, state) do
	Logger.debug("#{__MODULE__} received info: #{inspect(msg)}")

	{:ok, state}
	end

	@impl Phoenix.Socket.Transport
	def terminate(reason, state) do
	Logger.debug(
	"#{__MODULE__} terminating websocket connection for user #{(state.user \|\| %{id: "anonymous"}).id}, topics #{state.topics \|\| "?"}: #{inspect(reason)})"
	)

	Enum.each(state.topics, fn topic -> Streamer.remove_socket(topic) end)
	:ok
	end

	# Public streams without authentication.
	defp authenticate_request(nil) do
	{:ok, nil, nil}
	end

	# Authenticated streams.
	defp authenticate_request(access_token) do
	with oauth_token = %Token{user_id: user_id} <- Repo.get_by(Token, token: access_token),
	user = %User{} <- User.get_cached_by_id(user_id) do
	{:ok, user, oauth_token}
	else
	_ -> {:error, :unauthorized}
	end
	end

	defp handle_client_event(%{"type" => "subscribe", "stream" => _topic} = params, state) do
	with {_, {:ok, topic}} <-
	{:topic, Streamer.get_topic(params["stream"], state.user, state.oauth_token, params)},
	{_, false} <- {:subscribed, topic in state.topics} do
	Streamer.add_socket(topic, state.oauth_token)

	message =
	StreamerView.render("pleroma_respond.json", %{type: "subscribe", result: "success"})

	{:reply, :ok, {:text, message}, %{state \| topics: [topic \| state.topics]}}
	else
	{:subscribed, true} ->
	message =
	StreamerView.render("pleroma_respond.json", %{type: "subscribe", result: "ignored"})

	{:reply, :error, {:text, message}, state}

	{:topic, {:error, error}} ->
	message =
	StreamerView.render("pleroma_respond.json", %{
	type: "subscribe",
	result: "error",
	error: error
	})

	{:reply, :error, {:text, message}, state}
	end
	end

	defp handle_client_event(%{"type" => "unsubscribe", "stream" => _topic} = params, state) do
	with {_, {:ok, topic}} <-
	{:topic, Streamer.get_topic(params["stream"], state.user, state.oauth_token, params)},
	{_, true} <- {:subscribed, topic in state.topics} do
	Streamer.remove_socket(topic)

	message =
	StreamerView.render("pleroma_respond.json", %{type: "unsubscribe", result: "success"})

	{:reply, :ok, {:text, message}, %{state \| topics: List.delete(state.topics, topic)}}
	else
	{:subscribed, false} ->
	message =
	StreamerView.render("pleroma_respond.json", %{type: "unsubscribe", result: "ignored"})

	{:reply, :error, {:text, message}, state}

	{:topic, {:error, error}} ->
	message =
	StreamerView.render("pleroma_respond.json", %{
	type: "unsubscribe",
	result: "error",
	error: error
	})

	{:reply, :error, {:text, message}, state}
	end
	end

	defp handle_client_event(
	%{"type" => "pleroma:authenticate", "token" => access_token} = _params,
	state
	) do
	with {:auth, nil, nil} <- {:auth, state.user, state.oauth_token},
	{:ok, user, oauth_token} <- authenticate_request(access_token) do
	message =
	StreamerView.render("pleroma_respond.json", %{
	type: "pleroma:authenticate",
	result: "success"
	})

	{:reply, :ok, {:text, message}, %{state \| user: user, oauth_token: oauth_token}}
	else
	{:auth, _, _} ->
	message =
	StreamerView.render("pleroma_respond.json", %{
	type: "pleroma:authenticate",
	result: "error",
	error: :already_authenticated
	})

	{:reply, :error, {:text, message}, state}

	_ ->
	message =
	StreamerView.render("pleroma_respond.json", %{
	type: "pleroma:authenticate",
	result: "error",
	error: :unauthorized
	})

	{:reply, :error, {:text, message}, state}
	end
	end

	defp handle_client_event(params, state) do
	Logger.error("#{__MODULE__} received unknown event: #{inspect(params)}")
	{:ok, state}
	end

	def handle_error(conn, :unauthorized) do
	Plug.Conn.send_resp(conn, 401, "Unauthorized")
	end

	def handle_error(conn, _reason) do
	Plug.Conn.send_resp(conn, 404, "Not Found")
	end

	- defp find_access_token(%{params: %{"access_token" => token}}), do: token
	+ defp find_access_token(%{connect_info: %{sec_websocket_headers: sec_headers}} = transport_info) do
	+ find_sec_websocket_protocol(sec_headers) \|\| find_access_token_from_params(transport_info)
	+ end
	+
	+ defp find_access_token(transport_info), do: find_access_token_from_params(transport_info)
	+
	+ defp find_sec_websocket_protocol(sec_headers) do
	+ Enum.find_value(sec_headers, fn
	+ {"sec-websocket-protocol", token} -> token
	+ _ -> nil
	+ end)
	+ end

	- defp find_access_token(%{connect_info: %{sec_websocket_headers: sec_headers}}),
	- do:
	- Enum.find_value(sec_headers, fn
	- {"sec-websocket-protocol", v} -> v
	- _ -> nil
	- end)
	+ defp find_access_token_from_params(%{params: %{"access_token" => token}}), do: token

	- defp find_access_token(_), do: nil
	+ defp find_access_token_from_params(_), do: nil
	end
	diff --git a/test/pleroma/integration/mastodon_websocket_test.exs b/test/pleroma/integration/mastodon_websocket_test.exs
	index 47f6f5f76..604382be2 100644
	--- a/test/pleroma/integration/mastodon_websocket_test.exs
	+++ b/test/pleroma/integration/mastodon_websocket_test.exs
	@@ -1,496 +1,516 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Integration.MastodonWebsocketTest do
	# Needs a streamer, needs to stay synchronous
	use Pleroma.DataCase

	import ExUnit.CaptureLog
	import Pleroma.Factory

	alias Pleroma.Integration.WebsocketClient
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.OAuth

	@moduletag needs_streamer: true, capture_log: true

	@path Pleroma.Web.Endpoint.url()
	\|> URI.parse()
	\|> Map.put(:scheme, "ws")
	\|> Map.put(:path, "/api/v1/streaming")
	\|> URI.to_string()

	def start_socket(qs \\ nil, headers \\ []) do
	path =
	case qs do
	nil -> @path
	qs -> @path <> qs
	end

	WebsocketClient.start_link(self(), path, headers)
	end

	defp decode_json(json) do
	with {:ok, %{"event" => event, "payload" => payload_text}} <- Jason.decode(json),
	{:ok, payload} <- Jason.decode(payload_text) do
	{:ok, %{"event" => event, "payload" => payload}}
	end
	end

	# Turns atom keys to strings
	defp atom_key_to_string(json) do
	json
	\|> Jason.encode!()
	\|> Jason.decode!()
	end

	test "refuses invalid requests" do
	capture_log(fn ->
	assert {:error, %WebSockex.RequestError{code: 404}} = start_socket("?stream=ncjdk")
	Process.sleep(30)
	end)
	end

	test "requires authentication and a valid token for protected streams" do
	capture_log(fn ->
	assert {:error, %WebSockex.RequestError{code: 401}} =
	start_socket("?stream=user&access_token=aaaaaaaaaaaa")

	assert {:error, %WebSockex.RequestError{code: 401}} = start_socket("?stream=user")
	Process.sleep(30)
	end)
	end

	test "allows unified stream" do
	assert {:ok, _} = start_socket()
	end

	test "allows public streams without authentication" do
	assert {:ok, _} = start_socket("?stream=public")
	assert {:ok, _} = start_socket("?stream=public:local")
	assert {:ok, _} = start_socket("?stream=public:remote&instance=lain.com")
	assert {:ok, _} = start_socket("?stream=hashtag&tag=lain")
	end

	test "receives well formatted events" do
	user = insert(:user)
	{:ok, _} = start_socket("?stream=public")
	{:ok, activity} = CommonAPI.post(user, %{status: "nice echo chamber"})

	assert_receive {:text, raw_json}, 1_000
	assert {:ok, json} = Jason.decode(raw_json)

	assert "update" == json["event"]
	assert json["payload"]
	assert {:ok, json} = Jason.decode(json["payload"])

	view_json =
	Pleroma.Web.MastodonAPI.StatusView.render("show.json", activity: activity, for: nil)
	\|> atom_key_to_string()

	assert json == view_json
	end

	describe "subscribing via WebSocket" do
	test "can subscribe" do
	user = insert(:user)
	{:ok, pid} = start_socket()
	WebsocketClient.send_text(pid, %{type: "subscribe", stream: "public"} \|> Jason.encode!())
	assert_receive {:text, raw_json}, 1_000

	assert {:ok,
	%{
	"event" => "pleroma:respond",
	"payload" => %{"type" => "subscribe", "result" => "success"}
	}} = decode_json(raw_json)

	{:ok, activity} = CommonAPI.post(user, %{status: "nice echo chamber"})

	assert_receive {:text, raw_json}, 1_000
	assert {:ok, json} = Jason.decode(raw_json)

	assert "update" == json["event"]
	assert json["payload"]
	assert {:ok, json} = Jason.decode(json["payload"])

	view_json =
	Pleroma.Web.MastodonAPI.StatusView.render("show.json", activity: activity, for: nil)
	\|> Jason.encode!()
	\|> Jason.decode!()

	assert json == view_json
	end

	test "can subscribe to multiple streams" do
	user = insert(:user)
	{:ok, pid} = start_socket()
	WebsocketClient.send_text(pid, %{type: "subscribe", stream: "public"} \|> Jason.encode!())
	assert_receive {:text, raw_json}, 1_000

	assert {:ok,
	%{
	"event" => "pleroma:respond",
	"payload" => %{"type" => "subscribe", "result" => "success"}
	}} = decode_json(raw_json)

	WebsocketClient.send_text(
	pid,
	%{type: "subscribe", stream: "hashtag", tag: "mew"} \|> Jason.encode!()
	)

	assert_receive {:text, raw_json}, 1_000

	assert {:ok,
	%{
	"event" => "pleroma:respond",
	"payload" => %{"type" => "subscribe", "result" => "success"}
	}} = decode_json(raw_json)

	{:ok, _activity} = CommonAPI.post(user, %{status: "nice echo chamber #mew"})

	assert_receive {:text, raw_json}, 1_000
	assert {:ok, %{"stream" => stream1}} = Jason.decode(raw_json)
	assert_receive {:text, raw_json}, 1_000
	assert {:ok, %{"stream" => stream2}} = Jason.decode(raw_json)

	streams = [stream1, stream2]
	assert ["hashtag", "mew"] in streams
	assert ["public"] in streams
	end

	test "won't double subscribe" do
	user = insert(:user)
	{:ok, pid} = start_socket()
	WebsocketClient.send_text(pid, %{type: "subscribe", stream: "public"} \|> Jason.encode!())
	assert_receive {:text, raw_json}, 1_000

	assert {:ok,
	%{
	"event" => "pleroma:respond",
	"payload" => %{"type" => "subscribe", "result" => "success"}
	}} = decode_json(raw_json)

	WebsocketClient.send_text(pid, %{type: "subscribe", stream: "public"} \|> Jason.encode!())
	assert_receive {:text, raw_json}, 1_000

	assert {:ok,
	%{
	"event" => "pleroma:respond",
	"payload" => %{"type" => "subscribe", "result" => "ignored"}
	}} = decode_json(raw_json)

	{:ok, _activity} = CommonAPI.post(user, %{status: "nice echo chamber"})

	assert_receive {:text, _}, 1_000
	refute_receive {:text, _}, 1_000
	end

	test "rejects invalid streams" do
	{:ok, pid} = start_socket()
	WebsocketClient.send_text(pid, %{type: "subscribe", stream: "nonsense"} \|> Jason.encode!())
	assert_receive {:text, raw_json}, 1_000

	assert {:ok,
	%{
	"event" => "pleroma:respond",
	"payload" => %{"type" => "subscribe", "result" => "error", "error" => "bad_topic"}
	}} = decode_json(raw_json)
	end

	test "can unsubscribe" do
	user = insert(:user)
	{:ok, pid} = start_socket()
	WebsocketClient.send_text(pid, %{type: "subscribe", stream: "public"} \|> Jason.encode!())
	assert_receive {:text, raw_json}, 1_000

	assert {:ok,
	%{
	"event" => "pleroma:respond",
	"payload" => %{"type" => "subscribe", "result" => "success"}
	}} = decode_json(raw_json)

	WebsocketClient.send_text(pid, %{type: "unsubscribe", stream: "public"} \|> Jason.encode!())
	assert_receive {:text, raw_json}, 1_000

	assert {:ok,
	%{
	"event" => "pleroma:respond",
	"payload" => %{"type" => "unsubscribe", "result" => "success"}
	}} = decode_json(raw_json)

	{:ok, _activity} = CommonAPI.post(user, %{status: "nice echo chamber"})
	refute_receive {:text, _}, 1_000
	end
	end

	describe "with a valid user token" do
	setup do
	{:ok, app} =
	Pleroma.Repo.insert(
	OAuth.App.register_changeset(%OAuth.App{}, %{
	client_name: "client",
	scopes: ["read"],
	redirect_uris: "url"
	})
	)

	user = insert(:user)

	{:ok, auth} = OAuth.Authorization.create_authorization(app, user)

	{:ok, token} = OAuth.Token.exchange_token(app, auth)

	%{app: app, user: user, token: token}
	end

	test "accepts valid tokens", state do
	assert {:ok, _} = start_socket("?stream=user&access_token=#{state.token.token}")
	end

	test "accepts the 'user' stream", %{token: token} = _state do
	assert {:ok, _} = start_socket("?stream=user&access_token=#{token.token}")

	capture_log(fn ->
	assert {:error, %WebSockex.RequestError{code: 401}} = start_socket("?stream=user")
	Process.sleep(30)
	end)
	end

	test "accepts the 'user:notification' stream", %{token: token} = _state do
	assert {:ok, _} = start_socket("?stream=user:notification&access_token=#{token.token}")

	capture_log(fn ->
	assert {:error, %WebSockex.RequestError{code: 401}} =
	start_socket("?stream=user:notification")

	Process.sleep(30)
	end)
	end

	test "accepts valid token on Sec-WebSocket-Protocol header", %{token: token} do
	assert {:ok, _} = start_socket("?stream=user", [{"Sec-WebSocket-Protocol", token.token}])

	capture_log(fn ->
	assert {:error, %WebSockex.RequestError{code: 401}} =
	start_socket("?stream=user", [{"Sec-WebSocket-Protocol", "I am a friend"}])

	Process.sleep(30)
	end)
	end

	+ test "accepts Phoenix 1.8 sec-websocket headers connect info before query params", %{
	+ token: token,
	+ user: user
	+ } do
	+ assert {:ok, state} =
	+ Pleroma.Web.MastodonAPI.WebsocketHandler.connect(%{
	+ params: %{"stream" => "user", "access_token" => "invalid"},
	+ connect_info: %{
	+ sec_websocket_headers: [
	+ {"sec-websocket-version", "13"},
	+ {"sec-websocket-protocol", token.token}
	+ ]
	+ }
	+ })
	+
	+ assert state.user.id == user.id
	+ assert state.oauth_token.id == token.id
	+ assert state.topics != []
	+ end
	+
	test "accepts valid token on client-sent event", %{token: token} do
	assert {:ok, pid} = start_socket()

	WebsocketClient.send_text(
	pid,
	%{type: "pleroma:authenticate", token: token.token} \|> Jason.encode!()
	)

	assert_receive {:text, raw_json}, 1_000

	assert {:ok,
	%{
	"event" => "pleroma:respond",
	"payload" => %{"type" => "pleroma:authenticate", "result" => "success"}
	}} = decode_json(raw_json)

	WebsocketClient.send_text(pid, %{type: "subscribe", stream: "user"} \|> Jason.encode!())
	assert_receive {:text, raw_json}, 1_000

	assert {:ok,
	%{
	"event" => "pleroma:respond",
	"payload" => %{"type" => "subscribe", "result" => "success"}
	}} = decode_json(raw_json)
	end

	test "rejects invalid token on client-sent event" do
	assert {:ok, pid} = start_socket()

	WebsocketClient.send_text(
	pid,
	%{type: "pleroma:authenticate", token: "Something else"} \|> Jason.encode!()
	)

	assert_receive {:text, raw_json}, 1_000

	assert {:ok,
	%{
	"event" => "pleroma:respond",
	"payload" => %{
	"type" => "pleroma:authenticate",
	"result" => "error",
	"error" => "unauthorized"
	}
	}} = decode_json(raw_json)
	end

	test "rejects new authenticate request if already logged-in", %{token: token} do
	assert {:ok, pid} = start_socket()

	WebsocketClient.send_text(
	pid,
	%{type: "pleroma:authenticate", token: token.token} \|> Jason.encode!()
	)

	assert_receive {:text, raw_json}, 1_000

	assert {:ok,
	%{
	"event" => "pleroma:respond",
	"payload" => %{"type" => "pleroma:authenticate", "result" => "success"}
	}} = decode_json(raw_json)

	WebsocketClient.send_text(
	pid,
	%{type: "pleroma:authenticate", token: "Something else"} \|> Jason.encode!()
	)

	assert_receive {:text, raw_json}, 1_000

	assert {:ok,
	%{
	"event" => "pleroma:respond",
	"payload" => %{
	"type" => "pleroma:authenticate",
	"result" => "error",
	"error" => "already_authenticated"
	}
	}} = decode_json(raw_json)
	end

	test "accepts the 'list' stream", %{token: token, user: user} do
	posting_user = insert(:user)

	{:ok, list} = Pleroma.List.create(%{title: "test"}, user)
	Pleroma.List.follow(list, posting_user)

	assert {:ok, _} = start_socket("?stream=list&access_token=#{token.token}&list=#{list.id}")

	assert {:ok, pid} = start_socket("?access_token=#{token.token}")

	WebsocketClient.send_text(
	pid,
	%{type: "subscribe", stream: "list", list: list.id} \|> Jason.encode!()
	)

	assert_receive {:text, raw_json}, 1_000

	assert {:ok,
	%{
	"event" => "pleroma:respond",
	"payload" => %{"type" => "subscribe", "result" => "success"}
	}} = decode_json(raw_json)

	WebsocketClient.send_text(
	pid,
	%{type: "subscribe", stream: "list", list: to_string(list.id)} \|> Jason.encode!()
	)

	assert_receive {:text, raw_json}, 1_000

	assert {:ok,
	%{
	"event" => "pleroma:respond",
	"payload" => %{"type" => "subscribe", "result" => "ignored"}
	}} = decode_json(raw_json)
	end

	test "disconnect when token is revoked", %{app: app, user: user, token: token} do
	assert {:ok, _} = start_socket("?stream=user:notification&access_token=#{token.token}")
	assert {:ok, _} = start_socket("?stream=user&access_token=#{token.token}")

	{:ok, auth} = OAuth.Authorization.create_authorization(app, user)

	{:ok, token2} = OAuth.Token.exchange_token(app, auth)
	assert {:ok, _} = start_socket("?stream=user&access_token=#{token2.token}")

	OAuth.Token.Strategy.Revoke.revoke(token)

	assert_receive {:close, _}
	assert_receive {:close, _}
	refute_receive {:close, _}
	end

	test "receives private statuses", %{user: reading_user, token: token} do
	user = insert(:user)
	CommonAPI.follow(user, reading_user)

	{:ok, _} = start_socket("?stream=user&access_token=#{token.token}")

	{:ok, activity} =
	CommonAPI.post(user, %{status: "nice echo chamber", visibility: "private"})

	assert_receive {:text, raw_json}, 1_000
	assert {:ok, json} = Jason.decode(raw_json)

	assert "update" == json["event"]
	assert json["payload"]
	assert {:ok, json} = Jason.decode(json["payload"])

	view_json =
	Pleroma.Web.MastodonAPI.StatusView.render("show.json",
	activity: activity,
	for: reading_user
	)
	\|> Jason.encode!()
	\|> Jason.decode!()

	assert json == view_json
	end

	test "receives edits", %{user: reading_user, token: token} do
	user = insert(:user)
	CommonAPI.follow(user, reading_user)

	{:ok, _} = start_socket("?stream=user&access_token=#{token.token}")

	{:ok, activity} =
	CommonAPI.post(user, %{status: "nice echo chamber", visibility: "private"})

	assert_receive {:text, _raw_json}, 1_000

	{:ok, _} = CommonAPI.update(activity, user, %{status: "mew mew", visibility: "private"})

	assert_receive {:text, raw_json}, 1_000

	activity = Pleroma.Activity.normalize(activity)

	view_json =
	Pleroma.Web.MastodonAPI.StatusView.render("show.json",
	activity: activity,
	for: reading_user
	)
	\|> Jason.encode!()
	\|> Jason.decode!()

	assert {:ok, %{"event" => "status.update", "payload" => ^view_json}} = decode_json(raw_json)
	end

	test "receives notifications", %{user: reading_user, token: token} do
	user = insert(:user)
	CommonAPI.follow(user, reading_user)

	{:ok, _} = start_socket("?stream=user:notification&access_token=#{token.token}")

	{:ok, %Pleroma.Activity{id: activity_id} = _activity} =
	CommonAPI.post(user, %{
	status: "nice echo chamber @#{reading_user.nickname}",
	visibility: "private"
	})

	assert_receive {:text, raw_json}, 1_000

	assert {:ok,
	%{
	"event" => "notification",
	"payload" => %{
	"status" => %{
	"id" => ^activity_id
	}
	}
	}} = decode_json(raw_json)
	end
	end
	end
	diff --git a/test/pleroma/web/static_fe/static_fe_controller_test.exs b/test/pleroma/web/static_fe/static_fe_controller_test.exs
	index 2fae83305..68ded6906 100644
	--- a/test/pleroma/web/static_fe/static_fe_controller_test.exs
	+++ b/test/pleroma/web/static_fe/static_fe_controller_test.exs
	@@ -1,232 +1,241 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.StaticFE.StaticFEControllerTest do
	use Pleroma.Web.ConnCase

	alias Pleroma.Activity
	alias Pleroma.Web.ActivityPub.Transmogrifier
	alias Pleroma.Web.ActivityPub.Utils
	alias Pleroma.Web.CommonAPI

	import Pleroma.Factory

	setup_all do: clear_config([:static_fe, :enabled], true)

	setup %{conn: conn} do
	conn = put_req_header(conn, "accept", "text/html")
	user = insert(:user)

	%{conn: conn, user: user}
	end

	describe "user profile html" do
	test "just the profile as HTML", %{conn: conn, user: user} do
	conn = get(conn, "/users/#{user.nickname}")

	assert html_response(conn, 200) =~ user.nickname
	end

	+ test "renders profile HTML inside the default app layout", %{conn: conn, user: user} do
	+ conn = get(conn, "/users/#{user.nickname}")
	+
	+ html = html_response(conn, 200)
	+ assert html =~ "<!DOCTYPE html>"
	+ assert html =~ ~s(class="instance-header")
	+ assert html =~ ~s(<link rel="stylesheet" href="/instance/static.css">)
	+ end
	+
	test "404 when user not found", %{conn: conn} do
	conn = get(conn, "/users/limpopo")

	assert html_response(conn, 404) =~ "not found"
	end

	test "profile does not include private messages", %{conn: conn, user: user} do
	CommonAPI.post(user, %{status: "public"})
	CommonAPI.post(user, %{status: "private", visibility: "private"})

	conn = get(conn, "/users/#{user.nickname}")

	html = html_response(conn, 200)

	assert html =~ ">public<"
	refute html =~ ">private<"
	end

	test "pagination", %{conn: conn, user: user} do
	Enum.map(1..30, fn i -> CommonAPI.post(user, %{status: "test#{i}"}) end)

	conn = get(conn, "/users/#{user.nickname}")

	html = html_response(conn, 200)

	assert html =~ ">test30<"
	assert html =~ ">test11<"
	refute html =~ ">test10<"
	refute html =~ ">test1<"
	end

	test "pagination, page 2", %{conn: conn, user: user} do
	activities = Enum.map(1..30, fn i -> CommonAPI.post(user, %{status: "test#{i}"}) end)
	{:ok, a11} = Enum.at(activities, 11)

	conn = get(conn, "/users/#{user.nickname}?max_id=#{a11.id}")

	html = html_response(conn, 200)

	assert html =~ ">test1<"
	assert html =~ ">test10<"
	refute html =~ ">test20<"
	refute html =~ ">test29<"
	end

	test "does not require authentication on non-federating instances", %{
	conn: conn,
	user: user
	} do
	clear_config([:instance, :federating], false)

	conn = get(conn, "/users/#{user.nickname}")

	assert html_response(conn, 200) =~ user.nickname
	end

	test "returns 404 for local user with `restrict_unauthenticated/profiles/local` setting", %{
	conn: conn
	} do
	clear_config([:restrict_unauthenticated, :profiles, :local], true)

	local_user = insert(:user, local: true)

	conn
	\|> get("/users/#{local_user.nickname}")
	\|> html_response(404)
	end
	end

	describe "notice html" do
	test "single notice page", %{conn: conn, user: user} do
	{:ok, activity} = CommonAPI.post(user, %{status: "testing a thing!"})

	conn = get(conn, "/notice/#{activity.id}")

	html = html_response(conn, 200)
	assert html =~ "<header>"
	assert html =~ user.nickname
	assert html =~ "testing a thing!"
	end

	test "redirects to json if requested", %{conn: conn, user: user} do
	{:ok, activity} = CommonAPI.post(user, %{status: "testing a thing!"})

	conn =
	conn
	\|> put_req_header(
	"accept",
	"Accept: application/activity+json, application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\", text/html"
	)
	\|> get("/notice/#{activity.id}")

	assert redirected_to(conn, 302) =~ activity.data["object"]
	end

	test "filters HTML tags", %{conn: conn} do
	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{status: "<script>alert('xss')</script>"})

	conn =
	conn
	\|> put_req_header("accept", "text/html")
	\|> get("/notice/#{activity.id}")

	html = html_response(conn, 200)
	assert html =~ ~s[<script>alert('xss')</script>]
	end

	test "shows the whole thread", %{conn: conn, user: user} do
	{:ok, activity} = CommonAPI.post(user, %{status: "space: the final frontier"})

	CommonAPI.post(user, %{
	status: "these are the voyages or something",
	in_reply_to_status_id: activity.id
	})

	conn = get(conn, "/notice/#{activity.id}")

	html = html_response(conn, 200)
	assert html =~ "the final frontier"
	assert html =~ "voyages"
	end

	test "redirect by AP object ID", %{conn: conn, user: user} do
	{:ok, %Activity{data: %{"object" => object_url}}} =
	CommonAPI.post(user, %{status: "beam me up"})

	conn = get(conn, URI.parse(object_url).path)

	assert html_response(conn, 302) =~ "redirected"
	end

	test "redirect by activity ID", %{conn: conn, user: user} do
	{:ok, %Activity{data: %{"id" => id}}} =
	CommonAPI.post(user, %{status: "I'm a doctor, not a devops!"})

	conn = get(conn, URI.parse(id).path)

	assert html_response(conn, 302) =~ "redirected"
	end

	test "404 when notice not found", %{conn: conn} do
	conn = get(conn, "/notice/88c9c317")

	assert html_response(conn, 404) =~ "not found"
	end

	test "404 for private status", %{conn: conn, user: user} do
	{:ok, activity} = CommonAPI.post(user, %{status: "don't show me!", visibility: "private"})

	conn = get(conn, "/notice/#{activity.id}")

	assert html_response(conn, 404) =~ "not found"
	end

	test "302 for remote cached status", %{conn: conn, user: user} do
	message = %{
	"@context" => "https://www.w3.org/ns/activitystreams",
	"type" => "Create",
	"actor" => user.ap_id,
	"object" => %{
	"to" => user.follower_address,
	"cc" => "https://www.w3.org/ns/activitystreams#Public",
	"id" => Utils.generate_object_id(),
	"content" => "blah blah blah",
	"type" => "Note",
	"attributedTo" => user.ap_id
	}
	}

	assert {:ok, activity} = Transmogrifier.handle_incoming(message)

	conn = get(conn, "/notice/#{activity.id}")

	assert html_response(conn, 302) =~ "redirected"
	end

	test "does not require authentication on non-federating instances", %{
	conn: conn,
	user: user
	} do
	clear_config([:instance, :federating], false)

	{:ok, activity} = CommonAPI.post(user, %{status: "testing a thing!"})

	conn = get(conn, "/notice/#{activity.id}")

	assert html_response(conn, 200) =~ "testing a thing!"
	end

	test "returns 404 for local public activity with `restrict_unauthenticated/activities/local` setting",
	%{conn: conn, user: user} do
	clear_config([:restrict_unauthenticated, :activities, :local], true)

	{:ok, activity} = CommonAPI.post(user, %{status: "testing a thing!"})

	conn
	\|> get("/notice/#{activity.id}")
	\|> html_response(404)
	end
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Sat, Oct 31, 9:11 AM (12 h, 55 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1801213
Default Alt Text: (40 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions