No OneTemporary
Actions

Authored By

Unknown

Size

98 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/CHANGELOG.md b/CHANGELOG.md
	index 12c439135..d4a74d30c 100644
	--- a/CHANGELOG.md
	+++ b/CHANGELOG.md
	@@ -1,130 +1,131 @@
	# Changelog
	All notable changes to this project will be documented in this file.

	The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).

	## [unreleased]
	### Added
	- LDAP authentication
	- External OAuth provider authentication
	- A [job queue](https://git.pleroma.social/pleroma/pleroma_job_queue) for federation, emails, web push, etc.
	- [Prometheus](https://prometheus.io/) metrics
	- Support for Mastodon's remote interaction
	- Mix Tasks: `mix pleroma.database bump_all_conversations`
	- Mix Tasks: `mix pleroma.database remove_embedded_objects`
	- Mix Tasks: `mix pleroma.database update_users_following_followers_counts`
	- Mix Tasks: `mix pleroma.user toggle_confirmed`
	- Federation: Support for reports
	- Configuration: `safe_dm_mentions` option
	- Configuration: `link_name` option
	- Configuration: `fetch_initial_posts` option
	- Configuration: `notify_email` option
	- Configuration: Media proxy `whitelist` option
	- Configuration: `report_uri` option
	- Pleroma API: User subscriptions
	- Pleroma API: Healthcheck endpoint
	- Admin API: Endpoints for listing/revoking invite tokens
	- Admin API: Endpoints for making users follow/unfollow each other
	- Admin API: added filters (role, tags, email, name) for users endpoint
	- Admin API: Endpoints for managing reports
	- Admin API: Endpoints for deleting and changing the scope of individual reported statuses
	- AdminFE: initial release with basic user management accessible at /pleroma/admin/
	- Mastodon API: [Scheduled statuses](https://docs.joinmastodon.org/api/rest/scheduled-statuses/)
	- Mastodon API: `/api/v1/notifications/destroy_multiple` (glitch-soc extension)
	- Mastodon API: `/api/v1/pleroma/accounts/:id/favourites` (API extension)
	- Mastodon API: [Reports](https://docs.joinmastodon.org/api/rest/reports/)
	- Mastodon API: `POST /api/v1/accounts` (account creation API)
	- ActivityPub C2S: OAuth endpoints
	- Metadata: RelMe provider
	- OAuth: added support for refresh tokens
	- Emoji packs and emoji pack manager
	+- Ability to reset avatar, profile banner and backgroud

	### Changed
	- Breaking: Configuration: move from Pleroma.Mailer to Pleroma.Emails.Mailer
	- Enforcement of OAuth scopes
	- Add multiple use/time expiring invite token
	- Restyled OAuth pages to fit with Pleroma's default theme
	- Link/mention/hashtag detection is now handled by [auto_linker](https://git.pleroma.social/pleroma/auto_linker)
	- NodeInfo: Return `safe_dm_mentions` feature flag
	- Federation: Expand the audience of delete activities to all recipients of the deleted object
	- Federation: Removed `inReplyToStatusId` from objects
	- Configuration: Dedupe enabled by default
	- Configuration: Added `extra_cookie_attrs` for setting non-standard cookie attributes. Defaults to ["SameSite=Lax"] so that remote follows work.
	- Timelines: Messages involving people you have blocked will be excluded from the timeline in all cases instead of just repeats.
	- Admin API: Move the user related API to `api/pleroma/admin/users`
	- Pleroma API: Support for emoji tags in `/api/pleroma/emoji` resulting in a breaking API change
	- Mastodon API: Support for `exclude_types`, `limit` and `min_id` in `/api/v1/notifications`
	- Mastodon API: Add `languages` and `registrations` to `/api/v1/instance`
	- Mastodon API: Provide plaintext versions of cw/content in the Status entity
	- Mastodon API: Add `pleroma.conversation_id`, `pleroma.in_reply_to_account_acct` fields to the Status entity
	- Mastodon API: Add `pleroma.tags`, `pleroma.relationship{}`, `pleroma.is_moderator`, `pleroma.is_admin`, `pleroma.confirmation_pending`, `pleroma.hide_followers`, `pleroma.hide_follows`, `pleroma.hide_favorites` fields to the User entity
	- Mastodon API: Add `pleroma.show_role`, `pleroma.no_rich_text` fields to the Source subentity
	- Mastodon API: Add support for updating `no_rich_text`, `hide_followers`, `hide_follows`, `hide_favorites`, `show_role` in `PATCH /api/v1/update_credentials`
	- Mastodon API: Add `pleroma.is_seen` to the Notification entity
	- Mastodon API: Add `pleroma.local` to the Status entity
	- Mastodon API: Add `preview` parameter to `POST /api/v1/statuses`
	- Mastodon API: Add `with_muted` parameter to timeline endpoints
	- Mastodon API: Actual reblog hiding instead of a dummy
	- Mastodon API: Remove attachment limit in the Status entity
	- Mastodon API: Added support max_id & since_id for bookmark timeline endpoints.
	- Deps: Updated Cowboy to 2.6
	- Deps: Updated Ecto to 3.0.7
	- Don't ship finmoji by default, they can be installed as an emoji pack
	- Hide deactivated users and their statuses

	### Fixed
	- Added an FTS index on objects. Running `vacuum analyze` and setting a larger `work_mem` is recommended.
	- Followers counter not being updated when a follower is blocked
	- Deactivated users being able to request an access token
	- Limit on request body in rich media/relme parsers being ignored resulting in a possible memory leak
	- Proper Twitter Card generation instead of a dummy
	- Deletions failing for users with a large number of posts
	- NodeInfo: Include admins in `staffAccounts`
	- ActivityPub: Crashing when requesting empty local user's outbox
	- Federation: Handling of objects without `summary` property
	- Federation: Add a language tag to activities as required by ActivityStreams 2.0
	- Federation: Do not federate avatar/banner if set to default allowing other servers/clients to use their defaults
	- Federation: Cope with missing or explicitly nulled address lists
	- Federation: Explicitly ensure activities addressed to `as:Public` become addressed to the followers collection
	- Federation: Better cope with actors which do not declare a followers collection and use `as:Public` with these semantics
	- Federation: Follow requests from remote users who have been blocked will be automatically rejected if appropriate
	- MediaProxy: Parse name from content disposition headers even for non-whitelisted types
	- MediaProxy: S3 link encoding
	- Rich Media: Reject any data which cannot be explicitly encoded into JSON
	- Pleroma API: Importing follows from Mastodon 2.8+
	- Twitter API: Exposing default scope, `no_rich_text` of the user to anyone
	- Twitter API: Returning the `role` object in user entity despite `show_role = false`
	- Mastodon API: `/api/v1/favourites` serving only public activities
	- Mastodon API: Reblogs having `in_reply_to_id` - `null` even when they are replies
	- Mastodon API: Streaming API broadcasting wrong activity id
	- Mastodon API: 500 errors when requesting a card for a private conversation
	- Mastodon API: Handling of `reblogs` in `/api/v1/accounts/:id/follow`
	- Mastodon API: Correct `reblogged`, `favourited`, and `bookmarked` values in the reblog status JSON
	- Mastodon API: Exposing default scope of the user to anyone
	- Mastodon API: Make `irreversible` field default to `false` [`POST /api/v1/filters`]

	## Removed
	- Configuration: `config :pleroma, :fe` in favor of the more flexible `config :pleroma, :frontend_configurations`

	## [0.9.9999] - 2019-04-05
	### Security
	- Mastodon API: Fix content warnings skipping HTML sanitization

	## [0.9.999] - 2019-03-13
	Frontend changes only.
	### Added
	- Added floating action button for posting status on mobile
	### Changed
	- Changed user-settings icon to a pencil
	### Fixed
	- Keyboard shortcuts activating when typing a message
	- Gaps when scrolling down on a timeline after showing new

	## [0.9.99] - 2019-03-08
	### Changed
	- Update the frontend to the 0.9.99 tag
	### Fixed
	- Sign the date header in federation to fix Mastodon federation.

	## [0.9.9] - 2019-02-22
	This is our first stable release.
	diff --git a/lib/pleroma/web/twitter_api/twitter_api_controller.ex b/lib/pleroma/web/twitter_api/twitter_api_controller.ex
	index 31e86685a..a796e38fd 100644
	--- a/lib/pleroma/web/twitter_api/twitter_api_controller.ex
	+++ b/lib/pleroma/web/twitter_api/twitter_api_controller.ex
	@@ -1,755 +1,790 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.TwitterAPI.Controller do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper, only: [json_response: 3]

	alias Ecto.Changeset
	alias Pleroma.Activity
	alias Pleroma.Formatter
	alias Pleroma.Notification
	alias Pleroma.Object
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.CommonAPI.Utils
	alias Pleroma.Web.OAuth.Token
	alias Pleroma.Web.TwitterAPI.ActivityView
	alias Pleroma.Web.TwitterAPI.NotificationView
	alias Pleroma.Web.TwitterAPI.TokenView
	alias Pleroma.Web.TwitterAPI.TwitterAPI
	alias Pleroma.Web.TwitterAPI.UserView

	require Logger

	plug(:only_if_public_instance when action in [:public_timeline, :public_and_external_timeline])
	action_fallback(:errors)

	def verify_credentials(%{assigns: %{user: user}} = conn, _params) do
	token = Phoenix.Token.sign(conn, "user socket", user.id)

	conn
	\|> put_view(UserView)
	\|> render("show.json", %{user: user, token: token, for: user})
	end

	def status_update(%{assigns: %{user: user}} = conn, %{"status" => _} = status_data) do
	with media_ids <- extract_media_ids(status_data),
	{:ok, activity} <-
	TwitterAPI.create_status(user, Map.put(status_data, "media_ids", media_ids)) do
	conn
	\|> json(ActivityView.render("activity.json", activity: activity, for: user))
	else
	_ -> empty_status_reply(conn)
	end
	end

	def status_update(conn, _status_data) do
	empty_status_reply(conn)
	end

	defp empty_status_reply(conn) do
	bad_request_reply(conn, "Client must provide a 'status' parameter with a value.")
	end

	defp extract_media_ids(status_data) do
	with media_ids when not is_nil(media_ids) <- status_data["media_ids"],
	split_ids <- String.split(media_ids, ","),
	clean_ids <- Enum.reject(split_ids, fn id -> String.length(id) == 0 end) do
	clean_ids
	else
	_e -> []
	end
	end

	def public_and_external_timeline(%{assigns: %{user: user}} = conn, params) do
	params =
	params
	\|> Map.put("type", ["Create", "Announce"])
	\|> Map.put("blocking_user", user)

	activities = ActivityPub.fetch_public_activities(params)

	conn
	\|> put_view(ActivityView)
	\|> render("index.json", %{activities: activities, for: user})
	end

	def public_timeline(%{assigns: %{user: user}} = conn, params) do
	params =
	params
	\|> Map.put("type", ["Create", "Announce"])
	\|> Map.put("local_only", true)
	\|> Map.put("blocking_user", user)

	activities = ActivityPub.fetch_public_activities(params)

	conn
	\|> put_view(ActivityView)
	\|> render("index.json", %{activities: activities, for: user})
	end

	def friends_timeline(%{assigns: %{user: user}} = conn, params) do
	params =
	params
	\|> Map.put("type", ["Create", "Announce", "Follow", "Like"])
	\|> Map.put("blocking_user", user)
	\|> Map.put("user", user)

	activities = ActivityPub.fetch_activities([user.ap_id \| user.following], params)

	conn
	\|> put_view(ActivityView)
	\|> render("index.json", %{activities: activities, for: user})
	end

	def show_user(conn, params) do
	for_user = conn.assigns.user

	with {:ok, shown} <- TwitterAPI.get_user(params),
	true <-
	User.auth_active?(shown) \|\|
	(for_user && (for_user.id == shown.id \|\| User.superuser?(for_user))) do
	params =
	if for_user do
	%{user: shown, for: for_user}
	else
	%{user: shown}
	end

	conn
	\|> put_view(UserView)
	\|> render("show.json", params)
	else
	{:error, msg} ->
	bad_request_reply(conn, msg)

	false ->
	conn
	\|> put_status(404)
	\|> json(%{error: "Unconfirmed user"})
	end
	end

	def user_timeline(%{assigns: %{user: user}} = conn, params) do
	case TwitterAPI.get_user(user, params) do
	{:ok, target_user} ->
	# Twitter and ActivityPub use a different name and sense for this parameter.
	{include_rts, params} = Map.pop(params, "include_rts")

	params =
	case include_rts do
	x when x == "false" or x == "0" -> Map.put(params, "exclude_reblogs", "true")
	_ -> params
	end

	activities = ActivityPub.fetch_user_activities(target_user, user, params)

	conn
	\|> put_view(ActivityView)
	\|> render("index.json", %{activities: activities, for: user})

	{:error, msg} ->
	bad_request_reply(conn, msg)
	end
	end

	def mentions_timeline(%{assigns: %{user: user}} = conn, params) do
	params =
	params
	\|> Map.put("type", ["Create", "Announce", "Follow", "Like"])
	\|> Map.put("blocking_user", user)
	\|> Map.put(:visibility, ~w[unlisted public private])

	activities = ActivityPub.fetch_activities([user.ap_id], params)

	conn
	\|> put_view(ActivityView)
	\|> render("index.json", %{activities: activities, for: user})
	end

	def dm_timeline(%{assigns: %{user: user}} = conn, params) do
	params =
	params
	\|> Map.put("type", "Create")
	\|> Map.put("blocking_user", user)
	\|> Map.put("user", user)
	\|> Map.put(:visibility, "direct")
	\|> Map.put(:order, :desc)

	activities =
	ActivityPub.fetch_activities_query([user.ap_id], params)
	\|> Repo.all()

	conn
	\|> put_view(ActivityView)
	\|> render("index.json", %{activities: activities, for: user})
	end

	def notifications(%{assigns: %{user: user}} = conn, params) do
	notifications = Notification.for_user(user, params)

	conn
	\|> put_view(NotificationView)
	\|> render("notification.json", %{notifications: notifications, for: user})
	end

	def notifications_read(%{assigns: %{user: user}} = conn, %{"latest_id" => latest_id} = params) do
	Notification.set_read_up_to(user, latest_id)

	notifications = Notification.for_user(user, params)

	conn
	\|> put_view(NotificationView)
	\|> render("notification.json", %{notifications: notifications, for: user})
	end

	def notifications_read(%{assigns: %{user: _user}} = conn, _) do
	bad_request_reply(conn, "You need to specify latest_id")
	end

	def follow(%{assigns: %{user: user}} = conn, params) do
	case TwitterAPI.follow(user, params) do
	{:ok, user, followed, _activity} ->
	conn
	\|> put_view(UserView)
	\|> render("show.json", %{user: followed, for: user})

	{:error, msg} ->
	forbidden_json_reply(conn, msg)
	end
	end

	def block(%{assigns: %{user: user}} = conn, params) do
	case TwitterAPI.block(user, params) do
	{:ok, user, blocked} ->
	conn
	\|> put_view(UserView)
	\|> render("show.json", %{user: blocked, for: user})

	{:error, msg} ->
	forbidden_json_reply(conn, msg)
	end
	end

	def unblock(%{assigns: %{user: user}} = conn, params) do
	case TwitterAPI.unblock(user, params) do
	{:ok, user, blocked} ->
	conn
	\|> put_view(UserView)
	\|> render("show.json", %{user: blocked, for: user})

	{:error, msg} ->
	forbidden_json_reply(conn, msg)
	end
	end

	def delete_post(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with {:ok, activity} <- TwitterAPI.delete(user, id) do
	conn
	\|> put_view(ActivityView)
	\|> render("activity.json", %{activity: activity, for: user})
	end
	end

	def unfollow(%{assigns: %{user: user}} = conn, params) do
	case TwitterAPI.unfollow(user, params) do
	{:ok, user, unfollowed} ->
	conn
	\|> put_view(UserView)
	\|> render("show.json", %{user: unfollowed, for: user})

	{:error, msg} ->
	forbidden_json_reply(conn, msg)
	end
	end

	def fetch_status(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with %Activity{} = activity <- Activity.get_by_id(id),
	true <- Visibility.visible_for_user?(activity, user) do
	conn
	\|> put_view(ActivityView)
	\|> render("activity.json", %{activity: activity, for: user})
	end
	end

	def fetch_conversation(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with context when is_binary(context) <- Utils.conversation_id_to_context(id),
	activities <-
	ActivityPub.fetch_activities_for_context(context, %{
	"blocking_user" => user,
	"user" => user
	}) do
	conn
	\|> put_view(ActivityView)
	\|> render("index.json", %{activities: activities, for: user})
	end
	end

	@doc """
	Updates metadata of uploaded media object.
	Derived from [Twitter API endpoint](https://developer.twitter.com/en/docs/media/upload-media/api-reference/post-media-metadata-create).
	"""
	def update_media(%{assigns: %{user: user}} = conn, %{"media_id" => id} = data) do
	object = Repo.get(Object, id)
	description = get_in(data, ["alt_text", "text"]) \|\| data["name"] \|\| data["description"]

	{conn, status, response_body} =
	cond do
	!object ->
	{halt(conn), :not_found, ""}

	!Object.authorize_mutation(object, user) ->
	{halt(conn), :forbidden, "You can only update your own uploads."}

	!is_binary(description) ->
	{conn, :not_modified, ""}

	true ->
	new_data = Map.put(object.data, "name", description)

	{:ok, _} =
	object
	\|> Object.change(%{data: new_data})
	\|> Repo.update()

	{conn, :no_content, ""}
	end

	conn
	\|> put_status(status)
	\|> json(response_body)
	end

	def upload(%{assigns: %{user: user}} = conn, %{"media" => media}) do
	response = TwitterAPI.upload(media, user)

	conn
	\|> put_resp_content_type("application/atom+xml")
	\|> send_resp(200, response)
	end

	def upload_json(%{assigns: %{user: user}} = conn, %{"media" => media}) do
	response = TwitterAPI.upload(media, user, "json")

	conn
	\|> json_reply(200, response)
	end

	def get_by_id_or_ap_id(id) do
	activity = Activity.get_by_id(id) \|\| Activity.get_create_by_object_ap_id(id)

	if activity.data["type"] == "Create" do
	activity
	else
	Activity.get_create_by_object_ap_id(activity.data["object"])
	end
	end

	def favorite(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with {:ok, activity} <- TwitterAPI.fav(user, id) do
	conn
	\|> put_view(ActivityView)
	\|> render("activity.json", %{activity: activity, for: user})
	else
	_ -> json_reply(conn, 400, Jason.encode!(%{}))
	end
	end

	def unfavorite(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with {:ok, activity} <- TwitterAPI.unfav(user, id) do
	conn
	\|> put_view(ActivityView)
	\|> render("activity.json", %{activity: activity, for: user})
	else
	_ -> json_reply(conn, 400, Jason.encode!(%{}))
	end
	end

	def retweet(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with {:ok, activity} <- TwitterAPI.repeat(user, id) do
	conn
	\|> put_view(ActivityView)
	\|> render("activity.json", %{activity: activity, for: user})
	else
	_ -> json_reply(conn, 400, Jason.encode!(%{}))
	end
	end

	def unretweet(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with {:ok, activity} <- TwitterAPI.unrepeat(user, id) do
	conn
	\|> put_view(ActivityView)
	\|> render("activity.json", %{activity: activity, for: user})
	else
	_ -> json_reply(conn, 400, Jason.encode!(%{}))
	end
	end

	def pin(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with {:ok, activity} <- TwitterAPI.pin(user, id) do
	conn
	\|> put_view(ActivityView)
	\|> render("activity.json", %{activity: activity, for: user})
	else
	{:error, message} -> bad_request_reply(conn, message)
	err -> err
	end
	end

	def unpin(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with {:ok, activity} <- TwitterAPI.unpin(user, id) do
	conn
	\|> put_view(ActivityView)
	\|> render("activity.json", %{activity: activity, for: user})
	else
	{:error, message} -> bad_request_reply(conn, message)
	err -> err
	end
	end

	def register(conn, params) do
	with {:ok, user} <- TwitterAPI.register_user(params) do
	conn
	\|> put_view(UserView)
	\|> render("show.json", %{user: user})
	else
	{:error, errors} ->
	conn
	\|> json_reply(400, Jason.encode!(errors))
	end
	end

	def password_reset(conn, params) do
	nickname_or_email = params["email"] \|\| params["nickname"]

	with {:ok, _} <- TwitterAPI.password_reset(nickname_or_email) do
	json_response(conn, :no_content, "")
	end
	end

	def confirm_email(conn, %{"user_id" => uid, "token" => token}) do
	with %User{} = user <- User.get_cached_by_id(uid),
	true <- user.local,
	true <- user.info.confirmation_pending,
	true <- user.info.confirmation_token == token,
	info_change <- User.Info.confirmation_changeset(user.info, need_confirmation: false),
	changeset <- Changeset.change(user) \|> Changeset.put_embed(:info, info_change),
	{:ok, _} <- User.update_and_set_cache(changeset) do
	conn
	\|> redirect(to: "/")
	end
	end

	def resend_confirmation_email(conn, params) do
	nickname_or_email = params["email"] \|\| params["nickname"]

	with %User{} = user <- User.get_by_nickname_or_email(nickname_or_email),
	{:ok, _} <- User.try_send_confirmation_email(user) do
	conn
	\|> json_response(:no_content, "")
	end
	end

	+ def update_avatar(%{assigns: %{user: user}} = conn, %{"img" => ""}) do
	+ change = Changeset.change(user, %{avatar: nil})
	+ {:ok, user} = User.update_and_set_cache(change)
	+ CommonAPI.update(user)
	+
	+ conn
	+ \|> put_view(UserView)
	+ \|> render("show.json", %{user: user, for: user})
	+ end
	+
	def update_avatar(%{assigns: %{user: user}} = conn, params) do
	{:ok, object} = ActivityPub.upload(params, type: :avatar)
	change = Changeset.change(user, %{avatar: object.data})
	{:ok, user} = User.update_and_set_cache(change)
	CommonAPI.update(user)

	conn
	\|> put_view(UserView)
	\|> render("show.json", %{user: user, for: user})
	end

	+ def update_banner(%{assigns: %{user: user}} = conn, %{"banner" => ""}) do
	+ with new_info <- %{"banner" => %{}},
	+ info_cng <- User.Info.profile_update(user.info, new_info),
	+ changeset <- Ecto.Changeset.change(user) \|> Ecto.Changeset.put_embed(:info, info_cng),
	+ {:ok, user} <- User.update_and_set_cache(changeset) do
	+ CommonAPI.update(user)
	+ response = %{url: nil} \|> Jason.encode!()
	+
	+ conn
	+ \|> json_reply(200, response)
	+ end
	+ end
	+
	def update_banner(%{assigns: %{user: user}} = conn, params) do
	with {:ok, object} <- ActivityPub.upload(%{"img" => params["banner"]}, type: :banner),
	new_info <- %{"banner" => object.data},
	info_cng <- User.Info.profile_update(user.info, new_info),
	changeset <- Ecto.Changeset.change(user) \|> Ecto.Changeset.put_embed(:info, info_cng),
	{:ok, user} <- User.update_and_set_cache(changeset) do
	CommonAPI.update(user)
	%{"url" => [%{"href" => href} \| _]} = object.data
	response = %{url: href} \|> Jason.encode!()

	conn
	\|> json_reply(200, response)
	end
	end

	+ def update_background(%{assigns: %{user: user}} = conn, %{"img" => ""}) do
	+ with new_info <- %{"background" => %{}},
	+ info_cng <- User.Info.profile_update(user.info, new_info),
	+ changeset <- Ecto.Changeset.change(user) \|> Ecto.Changeset.put_embed(:info, info_cng),
	+ {:ok, _user} <- User.update_and_set_cache(changeset) do
	+ response = %{url: nil} \|> Jason.encode!()
	+
	+ conn
	+ \|> json_reply(200, response)
	+ end
	+ end
	+
	def update_background(%{assigns: %{user: user}} = conn, params) do
	with {:ok, object} <- ActivityPub.upload(params, type: :background),
	new_info <- %{"background" => object.data},
	info_cng <- User.Info.profile_update(user.info, new_info),
	changeset <- Ecto.Changeset.change(user) \|> Ecto.Changeset.put_embed(:info, info_cng),
	{:ok, _user} <- User.update_and_set_cache(changeset) do
	%{"url" => [%{"href" => href} \| _]} = object.data
	response = %{url: href} \|> Jason.encode!()

	conn
	\|> json_reply(200, response)
	end
	end

	def external_profile(%{assigns: %{user: current_user}} = conn, %{"profileurl" => uri}) do
	with {:ok, user_map} <- TwitterAPI.get_external_profile(current_user, uri),
	response <- Jason.encode!(user_map) do
	conn
	\|> json_reply(200, response)
	else
	_e ->
	conn
	\|> put_status(404)
	\|> json(%{error: "Can't find user"})
	end
	end

	def followers(%{assigns: %{user: for_user}} = conn, params) do
	{:ok, page} = Ecto.Type.cast(:integer, params["page"] \|\| 1)

	with {:ok, user} <- TwitterAPI.get_user(for_user, params),
	{:ok, followers} <- User.get_followers(user, page) do
	followers =
	cond do
	for_user && user.id == for_user.id -> followers
	user.info.hide_followers -> []
	true -> followers
	end

	conn
	\|> put_view(UserView)
	\|> render("index.json", %{users: followers, for: conn.assigns[:user]})
	else
	_e -> bad_request_reply(conn, "Can't get followers")
	end
	end

	def friends(%{assigns: %{user: for_user}} = conn, params) do
	{:ok, page} = Ecto.Type.cast(:integer, params["page"] \|\| 1)
	{:ok, export} = Ecto.Type.cast(:boolean, params["all"] \|\| false)

	page = if export, do: nil, else: page

	with {:ok, user} <- TwitterAPI.get_user(conn.assigns[:user], params),
	{:ok, friends} <- User.get_friends(user, page) do
	friends =
	cond do
	for_user && user.id == for_user.id -> friends
	user.info.hide_follows -> []
	true -> friends
	end

	conn
	\|> put_view(UserView)
	\|> render("index.json", %{users: friends, for: conn.assigns[:user]})
	else
	_e -> bad_request_reply(conn, "Can't get friends")
	end
	end

	def oauth_tokens(%{assigns: %{user: user}} = conn, _params) do
	with oauth_tokens <- Token.get_user_tokens(user) do
	conn
	\|> put_view(TokenView)
	\|> render("index.json", %{tokens: oauth_tokens})
	end
	end

	def revoke_token(%{assigns: %{user: user}} = conn, %{"id" => id} = _params) do
	Token.delete_user_token(user, id)

	json_reply(conn, 201, "")
	end

	def blocks(%{assigns: %{user: user}} = conn, _params) do
	with blocked_users <- User.blocked_users(user) do
	conn
	\|> put_view(UserView)
	\|> render("index.json", %{users: blocked_users, for: user})
	end
	end

	def friend_requests(conn, params) do
	with {:ok, user} <- TwitterAPI.get_user(conn.assigns[:user], params),
	{:ok, friend_requests} <- User.get_follow_requests(user) do
	conn
	\|> put_view(UserView)
	\|> render("index.json", %{users: friend_requests, for: conn.assigns[:user]})
	else
	_e -> bad_request_reply(conn, "Can't get friend requests")
	end
	end

	def approve_friend_request(conn, %{"user_id" => uid} = _params) do
	with followed <- conn.assigns[:user],
	%User{} = follower <- User.get_cached_by_id(uid),
	{:ok, follower} <- CommonAPI.accept_follow_request(follower, followed) do
	conn
	\|> put_view(UserView)
	\|> render("show.json", %{user: follower, for: followed})
	else
	e -> bad_request_reply(conn, "Can't approve user: #{inspect(e)}")
	end
	end

	def deny_friend_request(conn, %{"user_id" => uid} = _params) do
	with followed <- conn.assigns[:user],
	%User{} = follower <- User.get_cached_by_id(uid),
	{:ok, follower} <- CommonAPI.reject_follow_request(follower, followed) do
	conn
	\|> put_view(UserView)
	\|> render("show.json", %{user: follower, for: followed})
	else
	e -> bad_request_reply(conn, "Can't deny user: #{inspect(e)}")
	end
	end

	def friends_ids(%{assigns: %{user: user}} = conn, _params) do
	with {:ok, friends} <- User.get_friends(user) do
	ids =
	friends
	\|> Enum.map(fn x -> x.id end)
	\|> Jason.encode!()

	json(conn, ids)
	else
	_e -> bad_request_reply(conn, "Can't get friends")
	end
	end

	def empty_array(conn, _params) do
	json(conn, Jason.encode!([]))
	end

	def raw_empty_array(conn, _params) do
	json(conn, [])
	end

	defp build_info_cng(user, params) do
	info_params =
	["no_rich_text", "locked", "hide_followers", "hide_follows", "hide_favorites", "show_role"]
	\|> Enum.reduce(%{}, fn key, res ->
	if value = params[key] do
	Map.put(res, key, value == "true")
	else
	res
	end
	end)

	info_params =
	if value = params["default_scope"] do
	Map.put(info_params, "default_scope", value)
	else
	info_params
	end

	User.Info.profile_update(user.info, info_params)
	end

	defp parse_profile_bio(user, params) do
	if bio = params["description"] do
	emojis_text = (params["description"] \|\| "") <> " " <> (params["name"] \|\| "")

	emojis =
	((user.info.emoji \|\| []) ++ Formatter.get_emoji_map(emojis_text))
	\|> Enum.dedup()

	user_info =
	user.info
	\|> Map.put(
	"emoji",
	emojis
	)

	params
	\|> Map.put("bio", User.parse_bio(bio, user))
	\|> Map.put("info", user_info)
	else
	params
	end
	end

	def update_profile(%{assigns: %{user: user}} = conn, params) do
	params = parse_profile_bio(user, params)
	info_cng = build_info_cng(user, params)

	with changeset <- User.update_changeset(user, params),
	changeset <- Ecto.Changeset.put_embed(changeset, :info, info_cng),
	{:ok, user} <- User.update_and_set_cache(changeset) do
	CommonAPI.update(user)

	conn
	\|> put_view(UserView)
	\|> render("user.json", %{user: user, for: user})
	else
	error ->
	Logger.debug("Can't update user: #{inspect(error)}")
	bad_request_reply(conn, "Can't update user")
	end
	end

	def search(%{assigns: %{user: user}} = conn, %{"q" => _query} = params) do
	activities = TwitterAPI.search(user, params)

	conn
	\|> put_view(ActivityView)
	\|> render("index.json", %{activities: activities, for: user})
	end

	def search_user(%{assigns: %{user: user}} = conn, %{"query" => query}) do
	users = User.search(query, resolve: true, for_user: user)

	conn
	\|> put_view(UserView)
	\|> render("index.json", %{users: users, for: user})
	end

	defp bad_request_reply(conn, error_message) do
	json = error_json(conn, error_message)
	json_reply(conn, 400, json)
	end

	defp json_reply(conn, status, json) do
	conn
	\|> put_resp_content_type("application/json")
	\|> send_resp(status, json)
	end

	defp forbidden_json_reply(conn, error_message) do
	json = error_json(conn, error_message)
	json_reply(conn, 403, json)
	end

	def only_if_public_instance(%{assigns: %{user: %User{}}} = conn, _), do: conn

	def only_if_public_instance(conn, _) do
	if Keyword.get(Application.get_env(:pleroma, :instance), :public) do
	conn
	else
	conn
	\|> forbidden_json_reply("Invalid credentials.")
	\|> halt()
	end
	end

	defp error_json(conn, error_message) do
	%{"error" => error_message, "request" => conn.request_path} \|> Jason.encode!()
	end

	def errors(conn, {:param_cast, _}) do
	conn
	\|> put_status(400)
	\|> json("Invalid parameters")
	end

	def errors(conn, _) do
	conn
	\|> put_status(500)
	\|> json("Something went wrong")
	end
	end
	diff --git a/test/web/twitter_api/twitter_api_controller_test.exs b/test/web/twitter_api/twitter_api_controller_test.exs
	index e194f14fb..373efa639 100644
	--- a/test/web/twitter_api/twitter_api_controller_test.exs
	+++ b/test/web/twitter_api/twitter_api_controller_test.exs
	@@ -1,2097 +1,2134 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.TwitterAPI.ControllerTest do
	use Pleroma.Web.ConnCase
	alias Comeonin.Pbkdf2
	alias Ecto.Changeset
	alias Pleroma.Activity
	alias Pleroma.Builders.ActivityBuilder
	alias Pleroma.Builders.UserBuilder
	alias Pleroma.Notification
	alias Pleroma.Object
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.OAuth.Token
	alias Pleroma.Web.TwitterAPI.ActivityView
	alias Pleroma.Web.TwitterAPI.Controller
	alias Pleroma.Web.TwitterAPI.NotificationView
	alias Pleroma.Web.TwitterAPI.TwitterAPI
	alias Pleroma.Web.TwitterAPI.UserView

	import Mock
	import Pleroma.Factory
	import Swoosh.TestAssertions

	@banner "data:image/gif;base64,R0lGODlhEAAQAMQAAORHHOVSKudfOulrSOp3WOyDZu6QdvCchPGolfO0o/XBs/fNwfjZ0frl3/zy7////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAkAABAALAAAAAAQABAAAAVVICSOZGlCQAosJ6mu7fiyZeKqNKToQGDsM8hBADgUXoGAiqhSvp5QAnQKGIgUhwFUYLCVDFCrKUE1lBavAViFIDlTImbKC5Gm2hB0SlBCBMQiB0UjIQA7"

	describe "POST /api/account/update_profile_banner" do
	test "it updates the banner", %{conn: conn} do
	user = insert(:user)

	conn
	\|> assign(:user, user)
	\|> post(authenticated_twitter_api__path(conn, :update_banner), %{"banner" => @banner})
	\|> json_response(200)

	user = refresh_record(user)
	assert user.info.banner["type"] == "Image"
	end
	+
	+ test "profile banner can be reset", %{conn: conn} do
	+ user = insert(:user)
	+
	+ conn
	+ \|> assign(:user, user)
	+ \|> post(authenticated_twitter_api__path(conn, :update_banner), %{"banner" => ""})
	+ \|> json_response(200)
	+
	+ user = refresh_record(user)
	+ assert user.info.banner == %{}
	+ end
	end

	describe "POST /api/qvitter/update_background_image" do
	test "it updates the background", %{conn: conn} do
	user = insert(:user)

	conn
	\|> assign(:user, user)
	\|> post(authenticated_twitter_api__path(conn, :update_background), %{"img" => @banner})
	\|> json_response(200)

	user = refresh_record(user)
	assert user.info.background["type"] == "Image"
	end
	+
	+ test "background can be reset", %{conn: conn} do
	+ user = insert(:user)
	+
	+ conn
	+ \|> assign(:user, user)
	+ \|> post(authenticated_twitter_api__path(conn, :update_background), %{"img" => ""})
	+ \|> json_response(200)
	+
	+ user = refresh_record(user)
	+ assert user.info.background == %{}
	+ end
	end

	describe "POST /api/account/verify_credentials" do
	setup [:valid_user]

	test "without valid credentials", %{conn: conn} do
	conn = post(conn, "/api/account/verify_credentials.json")
	assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
	end

	test "with credentials", %{conn: conn, user: user} do
	response =
	conn
	\|> with_credentials(user.nickname, "test")
	\|> post("/api/account/verify_credentials.json")
	\|> json_response(200)

	assert response ==
	UserView.render("show.json", %{user: user, token: response["token"], for: user})
	end
	end

	describe "POST /statuses/update.json" do
	setup [:valid_user]

	test "without valid credentials", %{conn: conn} do
	conn = post(conn, "/api/statuses/update.json")
	assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
	end

	test "with credentials", %{conn: conn, user: user} do
	conn_with_creds = conn \|> with_credentials(user.nickname, "test")
	request_path = "/api/statuses/update.json"

	error_response = %{
	"request" => request_path,
	"error" => "Client must provide a 'status' parameter with a value."
	}

	conn =
	conn_with_creds
	\|> post(request_path)

	assert json_response(conn, 400) == error_response

	conn =
	conn_with_creds
	\|> post(request_path, %{status: ""})

	assert json_response(conn, 400) == error_response

	conn =
	conn_with_creds
	\|> post(request_path, %{status: " "})

	assert json_response(conn, 400) == error_response

	# we post with visibility private in order to avoid triggering relay
	conn =
	conn_with_creds
	\|> post(request_path, %{status: "Nice meme.", visibility: "private"})

	assert json_response(conn, 200) ==
	ActivityView.render("activity.json", %{
	activity: Repo.one(Activity),
	user: user,
	for: user
	})
	end
	end

	describe "GET /statuses/public_timeline.json" do
	setup [:valid_user]

	test "returns statuses", %{conn: conn} do
	user = insert(:user)
	activities = ActivityBuilder.insert_list(30, %{}, %{user: user})
	ActivityBuilder.insert_list(10, %{}, %{user: user})
	since_id = List.last(activities).id

	conn =
	conn
	\|> get("/api/statuses/public_timeline.json", %{since_id: since_id})

	response = json_response(conn, 200)

	assert length(response) == 10
	end

	test "returns 403 to unauthenticated request when the instance is not public", %{conn: conn} do
	instance =
	Application.get_env(:pleroma, :instance)
	\|> Keyword.put(:public, false)

	Application.put_env(:pleroma, :instance, instance)

	conn
	\|> get("/api/statuses/public_timeline.json")
	\|> json_response(403)

	instance =
	Application.get_env(:pleroma, :instance)
	\|> Keyword.put(:public, true)

	Application.put_env(:pleroma, :instance, instance)
	end

	test "returns 200 to authenticated request when the instance is not public",
	%{conn: conn, user: user} do
	instance =
	Application.get_env(:pleroma, :instance)
	\|> Keyword.put(:public, false)

	Application.put_env(:pleroma, :instance, instance)

	conn
	\|> with_credentials(user.nickname, "test")
	\|> get("/api/statuses/public_timeline.json")
	\|> json_response(200)

	instance =
	Application.get_env(:pleroma, :instance)
	\|> Keyword.put(:public, true)

	Application.put_env(:pleroma, :instance, instance)
	end

	test "returns 200 to unauthenticated request when the instance is public", %{conn: conn} do
	conn
	\|> get("/api/statuses/public_timeline.json")
	\|> json_response(200)
	end

	test "returns 200 to authenticated request when the instance is public",
	%{conn: conn, user: user} do
	conn
	\|> with_credentials(user.nickname, "test")
	\|> get("/api/statuses/public_timeline.json")
	\|> json_response(200)
	end

	test_with_mock "treats user as unauthenticated if `assigns[:token]` is present but lacks `read` permission",
	Controller,
	[:passthrough],
	[] do
	token = insert(:oauth_token, scopes: ["write"])

	build_conn()
	\|> put_req_header("authorization", "Bearer #{token.token}")
	\|> get("/api/statuses/public_timeline.json")
	\|> json_response(200)

	assert called(Controller.public_timeline(%{assigns: %{user: nil}}, :_))
	end
	end

	describe "GET /statuses/public_and_external_timeline.json" do
	setup [:valid_user]

	test "returns 403 to unauthenticated request when the instance is not public", %{conn: conn} do
	instance =
	Application.get_env(:pleroma, :instance)
	\|> Keyword.put(:public, false)

	Application.put_env(:pleroma, :instance, instance)

	conn
	\|> get("/api/statuses/public_and_external_timeline.json")
	\|> json_response(403)

	instance =
	Application.get_env(:pleroma, :instance)
	\|> Keyword.put(:public, true)

	Application.put_env(:pleroma, :instance, instance)
	end

	test "returns 200 to authenticated request when the instance is not public",
	%{conn: conn, user: user} do
	instance =
	Application.get_env(:pleroma, :instance)
	\|> Keyword.put(:public, false)

	Application.put_env(:pleroma, :instance, instance)

	conn
	\|> with_credentials(user.nickname, "test")
	\|> get("/api/statuses/public_and_external_timeline.json")
	\|> json_response(200)

	instance =
	Application.get_env(:pleroma, :instance)
	\|> Keyword.put(:public, true)

	Application.put_env(:pleroma, :instance, instance)
	end

	test "returns 200 to unauthenticated request when the instance is public", %{conn: conn} do
	conn
	\|> get("/api/statuses/public_and_external_timeline.json")
	\|> json_response(200)
	end

	test "returns 200 to authenticated request when the instance is public",
	%{conn: conn, user: user} do
	conn
	\|> with_credentials(user.nickname, "test")
	\|> get("/api/statuses/public_and_external_timeline.json")
	\|> json_response(200)
	end
	end

	describe "GET /statuses/show/:id.json" do
	test "returns one status", %{conn: conn} do
	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{"status" => "Hey!"})
	actor = User.get_cached_by_ap_id(activity.data["actor"])

	conn =
	conn
	\|> get("/api/statuses/show/#{activity.id}.json")

	response = json_response(conn, 200)

	assert response == ActivityView.render("activity.json", %{activity: activity, user: actor})
	end
	end

	describe "GET /users/show.json" do
	test "gets user with screen_name", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> get("/api/users/show.json", %{"screen_name" => user.nickname})

	response = json_response(conn, 200)

	assert response["id"] == user.id
	end

	test "gets user with user_id", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> get("/api/users/show.json", %{"user_id" => user.id})

	response = json_response(conn, 200)

	assert response["id"] == user.id
	end

	test "gets a user for a logged in user", %{conn: conn} do
	user = insert(:user)
	logged_in = insert(:user)

	{:ok, logged_in, user, _activity} = TwitterAPI.follow(logged_in, %{"user_id" => user.id})

	conn =
	conn
	\|> with_credentials(logged_in.nickname, "test")
	\|> get("/api/users/show.json", %{"user_id" => user.id})

	response = json_response(conn, 200)

	assert response["following"] == true
	end
	end

	describe "GET /statusnet/conversation/:id.json" do
	test "returns the statuses in the conversation", %{conn: conn} do
	{:ok, _user} = UserBuilder.insert()
	{:ok, activity} = ActivityBuilder.insert(%{"type" => "Create", "context" => "2hu"})
	{:ok, _activity_two} = ActivityBuilder.insert(%{"type" => "Create", "context" => "2hu"})
	{:ok, _activity_three} = ActivityBuilder.insert(%{"type" => "Create", "context" => "3hu"})

	conn =
	conn
	\|> get("/api/statusnet/conversation/#{activity.data["context_id"]}.json")

	response = json_response(conn, 200)

	assert length(response) == 2
	end
	end

	describe "GET /statuses/friends_timeline.json" do
	setup [:valid_user]

	test "without valid credentials", %{conn: conn} do
	conn = get(conn, "/api/statuses/friends_timeline.json")
	assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
	end

	test "with credentials", %{conn: conn, user: current_user} do
	user = insert(:user)

	activities =
	ActivityBuilder.insert_list(30, %{"to" => [User.ap_followers(user)]}, %{user: user})

	returned_activities =
	ActivityBuilder.insert_list(10, %{"to" => [User.ap_followers(user)]}, %{user: user})

	other_user = insert(:user)
	ActivityBuilder.insert_list(10, %{}, %{user: other_user})
	since_id = List.last(activities).id

	current_user =
	Changeset.change(current_user, following: [User.ap_followers(user)])
	\|> Repo.update!()

	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> get("/api/statuses/friends_timeline.json", %{since_id: since_id})

	response = json_response(conn, 200)

	assert length(response) == 10

	assert response ==
	Enum.map(returned_activities, fn activity ->
	ActivityView.render("activity.json", %{
	activity: activity,
	user: User.get_cached_by_ap_id(activity.data["actor"]),
	for: current_user
	})
	end)
	end
	end

	describe "GET /statuses/dm_timeline.json" do
	test "it show direct messages", %{conn: conn} do
	user_one = insert(:user)
	user_two = insert(:user)

	{:ok, user_two} = User.follow(user_two, user_one)

	{:ok, direct} =
	CommonAPI.post(user_one, %{
	"status" => "Hi @#{user_two.nickname}!",
	"visibility" => "direct"
	})

	{:ok, direct_two} =
	CommonAPI.post(user_two, %{
	"status" => "Hi @#{user_one.nickname}!",
	"visibility" => "direct"
	})

	{:ok, _follower_only} =
	CommonAPI.post(user_one, %{
	"status" => "Hi @#{user_two.nickname}!",
	"visibility" => "private"
	})

	# Only direct should be visible here
	res_conn =
	conn
	\|> assign(:user, user_two)
	\|> get("/api/statuses/dm_timeline.json")

	[status, status_two] = json_response(res_conn, 200)
	assert status["id"] == direct_two.id
	assert status_two["id"] == direct.id
	end

	test "doesn't include DMs from blocked users", %{conn: conn} do
	blocker = insert(:user)
	blocked = insert(:user)
	user = insert(:user)
	{:ok, blocker} = User.block(blocker, blocked)

	{:ok, _blocked_direct} =
	CommonAPI.post(blocked, %{
	"status" => "Hi @#{blocker.nickname}!",
	"visibility" => "direct"
	})

	{:ok, direct} =
	CommonAPI.post(user, %{
	"status" => "Hi @#{blocker.nickname}!",
	"visibility" => "direct"
	})

	res_conn =
	conn
	\|> assign(:user, blocker)
	\|> get("/api/statuses/dm_timeline.json")

	[status] = json_response(res_conn, 200)
	assert status["id"] == direct.id
	end
	end

	describe "GET /statuses/mentions.json" do
	setup [:valid_user]

	test "without valid credentials", %{conn: conn} do
	conn = get(conn, "/api/statuses/mentions.json")
	assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
	end

	test "with credentials", %{conn: conn, user: current_user} do
	{:ok, activity} =
	CommonAPI.post(current_user, %{
	"status" => "why is tenshi eating a corndog so cute?",
	"visibility" => "public"
	})

	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> get("/api/statuses/mentions.json")

	response = json_response(conn, 200)

	assert length(response) == 1

	assert Enum.at(response, 0) ==
	ActivityView.render("activity.json", %{
	user: current_user,
	for: current_user,
	activity: activity
	})
	end

	test "does not show DMs in mentions timeline", %{conn: conn, user: current_user} do
	{:ok, _activity} =
	CommonAPI.post(current_user, %{
	"status" => "Have you guys ever seen how cute tenshi eating a corndog is?",
	"visibility" => "direct"
	})

	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> get("/api/statuses/mentions.json")

	response = json_response(conn, 200)

	assert Enum.empty?(response)
	end
	end

	describe "GET /api/qvitter/statuses/notifications.json" do
	setup [:valid_user]

	test "without valid credentials", %{conn: conn} do
	conn = get(conn, "/api/qvitter/statuses/notifications.json")
	assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
	end

	test "with credentials", %{conn: conn, user: current_user} do
	other_user = insert(:user)

	{:ok, _activity} =
	ActivityBuilder.insert(%{"to" => [current_user.ap_id]}, %{user: other_user})

	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> get("/api/qvitter/statuses/notifications.json")

	response = json_response(conn, 200)

	assert length(response) == 1

	assert response ==
	NotificationView.render("notification.json", %{
	notifications: Notification.for_user(current_user),
	for: current_user
	})
	end
	end

	describe "POST /api/qvitter/statuses/notifications/read" do
	setup [:valid_user]

	test "without valid credentials", %{conn: conn} do
	conn = post(conn, "/api/qvitter/statuses/notifications/read", %{"latest_id" => 1_234_567})
	assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
	end

	test "with credentials, without any params", %{conn: conn, user: current_user} do
	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> post("/api/qvitter/statuses/notifications/read")

	assert json_response(conn, 400) == %{
	"error" => "You need to specify latest_id",
	"request" => "/api/qvitter/statuses/notifications/read"
	}
	end

	test "with credentials, with params", %{conn: conn, user: current_user} do
	other_user = insert(:user)

	{:ok, _activity} =
	ActivityBuilder.insert(%{"to" => [current_user.ap_id]}, %{user: other_user})

	response_conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> get("/api/qvitter/statuses/notifications.json")

	[notification] = response = json_response(response_conn, 200)

	assert length(response) == 1

	assert notification["is_seen"] == 0

	response_conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> post("/api/qvitter/statuses/notifications/read", %{"latest_id" => notification["id"]})

	[notification] = response = json_response(response_conn, 200)

	assert length(response) == 1

	assert notification["is_seen"] == 1
	end
	end

	describe "GET /statuses/user_timeline.json" do
	setup [:valid_user]

	test "without any params", %{conn: conn} do
	conn = get(conn, "/api/statuses/user_timeline.json")

	assert json_response(conn, 400) == %{
	"error" => "You need to specify screen_name or user_id",
	"request" => "/api/statuses/user_timeline.json"
	}
	end

	test "with user_id", %{conn: conn} do
	user = insert(:user)
	{:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: user})

	conn = get(conn, "/api/statuses/user_timeline.json", %{"user_id" => user.id})
	response = json_response(conn, 200)
	assert length(response) == 1

	assert Enum.at(response, 0) ==
	ActivityView.render("activity.json", %{user: user, activity: activity})
	end

	test "with screen_name", %{conn: conn} do
	user = insert(:user)
	{:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: user})

	conn = get(conn, "/api/statuses/user_timeline.json", %{"screen_name" => user.nickname})
	response = json_response(conn, 200)
	assert length(response) == 1

	assert Enum.at(response, 0) ==
	ActivityView.render("activity.json", %{user: user, activity: activity})
	end

	test "with credentials", %{conn: conn, user: current_user} do
	{:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: current_user})

	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> get("/api/statuses/user_timeline.json")

	response = json_response(conn, 200)

	assert length(response) == 1

	assert Enum.at(response, 0) ==
	ActivityView.render("activity.json", %{
	user: current_user,
	for: current_user,
	activity: activity
	})
	end

	test "with credentials with user_id", %{conn: conn, user: current_user} do
	user = insert(:user)
	{:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: user})

	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> get("/api/statuses/user_timeline.json", %{"user_id" => user.id})

	response = json_response(conn, 200)

	assert length(response) == 1

	assert Enum.at(response, 0) ==
	ActivityView.render("activity.json", %{user: user, activity: activity})
	end

	test "with credentials screen_name", %{conn: conn, user: current_user} do
	user = insert(:user)
	{:ok, activity} = ActivityBuilder.insert(%{"id" => 1}, %{user: user})

	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> get("/api/statuses/user_timeline.json", %{"screen_name" => user.nickname})

	response = json_response(conn, 200)

	assert length(response) == 1

	assert Enum.at(response, 0) ==
	ActivityView.render("activity.json", %{user: user, activity: activity})
	end

	test "with credentials with user_id, excluding RTs", %{conn: conn, user: current_user} do
	user = insert(:user)
	{:ok, activity} = ActivityBuilder.insert(%{"id" => 1, "type" => "Create"}, %{user: user})
	{:ok, _} = ActivityBuilder.insert(%{"id" => 2, "type" => "Announce"}, %{user: user})

	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> get("/api/statuses/user_timeline.json", %{
	"user_id" => user.id,
	"include_rts" => "false"
	})

	response = json_response(conn, 200)

	assert length(response) == 1

	assert Enum.at(response, 0) ==
	ActivityView.render("activity.json", %{user: user, activity: activity})

	conn =
	conn
	\|> get("/api/statuses/user_timeline.json", %{"user_id" => user.id, "include_rts" => "0"})

	response = json_response(conn, 200)

	assert length(response) == 1

	assert Enum.at(response, 0) ==
	ActivityView.render("activity.json", %{user: user, activity: activity})
	end
	end

	describe "POST /friendships/create.json" do
	setup [:valid_user]

	test "without valid credentials", %{conn: conn} do
	conn = post(conn, "/api/friendships/create.json")
	assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
	end

	test "with credentials", %{conn: conn, user: current_user} do
	followed = insert(:user)

	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> post("/api/friendships/create.json", %{user_id: followed.id})

	current_user = User.get_cached_by_id(current_user.id)
	assert User.ap_followers(followed) in current_user.following

	assert json_response(conn, 200) ==
	UserView.render("show.json", %{user: followed, for: current_user})
	end

	test "for restricted account", %{conn: conn, user: current_user} do
	followed = insert(:user, info: %User.Info{locked: true})

	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> post("/api/friendships/create.json", %{user_id: followed.id})

	current_user = User.get_cached_by_id(current_user.id)
	followed = User.get_cached_by_id(followed.id)

	refute User.ap_followers(followed) in current_user.following

	assert json_response(conn, 200) ==
	UserView.render("show.json", %{user: followed, for: current_user})
	end
	end

	describe "POST /friendships/destroy.json" do
	setup [:valid_user]

	test "without valid credentials", %{conn: conn} do
	conn = post(conn, "/api/friendships/destroy.json")
	assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
	end

	test "with credentials", %{conn: conn, user: current_user} do
	followed = insert(:user)

	{:ok, current_user} = User.follow(current_user, followed)
	assert User.ap_followers(followed) in current_user.following
	ActivityPub.follow(current_user, followed)

	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> post("/api/friendships/destroy.json", %{user_id: followed.id})

	current_user = User.get_cached_by_id(current_user.id)
	assert current_user.following == [current_user.ap_id]

	assert json_response(conn, 200) ==
	UserView.render("show.json", %{user: followed, for: current_user})
	end
	end

	describe "POST /blocks/create.json" do
	setup [:valid_user]

	test "without valid credentials", %{conn: conn} do
	conn = post(conn, "/api/blocks/create.json")
	assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
	end

	test "with credentials", %{conn: conn, user: current_user} do
	blocked = insert(:user)

	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> post("/api/blocks/create.json", %{user_id: blocked.id})

	current_user = User.get_cached_by_id(current_user.id)
	assert User.blocks?(current_user, blocked)

	assert json_response(conn, 200) ==
	UserView.render("show.json", %{user: blocked, for: current_user})
	end
	end

	describe "POST /blocks/destroy.json" do
	setup [:valid_user]

	test "without valid credentials", %{conn: conn} do
	conn = post(conn, "/api/blocks/destroy.json")
	assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
	end

	test "with credentials", %{conn: conn, user: current_user} do
	blocked = insert(:user)

	{:ok, current_user, blocked} = TwitterAPI.block(current_user, %{"user_id" => blocked.id})
	assert User.blocks?(current_user, blocked)

	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> post("/api/blocks/destroy.json", %{user_id: blocked.id})

	current_user = User.get_cached_by_id(current_user.id)
	assert current_user.info.blocks == []

	assert json_response(conn, 200) ==
	UserView.render("show.json", %{user: blocked, for: current_user})
	end
	end

	describe "GET /help/test.json" do
	test "returns \"ok\"", %{conn: conn} do
	conn = get(conn, "/api/help/test.json")
	assert json_response(conn, 200) == "ok"
	end
	end

	describe "POST /api/qvitter/update_avatar.json" do
	setup [:valid_user]

	test "without valid credentials", %{conn: conn} do
	conn = post(conn, "/api/qvitter/update_avatar.json")
	assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
	end

	test "with credentials", %{conn: conn, user: current_user} do
	avatar_image = File.read!("test/fixtures/avatar_data_uri")

	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> post("/api/qvitter/update_avatar.json", %{img: avatar_image})

	current_user = User.get_cached_by_id(current_user.id)
	assert is_map(current_user.avatar)

	assert json_response(conn, 200) ==
	UserView.render("show.json", %{user: current_user, for: current_user})
	end
	+
	+ test "user avatar can be reset", %{conn: conn, user: current_user} do
	+ conn =
	+ conn
	+ \|> with_credentials(current_user.nickname, "test")
	+ \|> post("/api/qvitter/update_avatar.json", %{img: ""})
	+
	+ current_user = User.get_cached_by_id(current_user.id)
	+ assert current_user.avatar == nil
	+
	+ assert json_response(conn, 200) ==
	+ UserView.render("show.json", %{user: current_user, for: current_user})
	+ end
	end

	describe "GET /api/qvitter/mutes.json" do
	setup [:valid_user]

	test "unimplemented mutes without valid credentials", %{conn: conn} do
	conn = get(conn, "/api/qvitter/mutes.json")
	assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
	end

	test "unimplemented mutes with credentials", %{conn: conn, user: current_user} do
	response =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> get("/api/qvitter/mutes.json")
	\|> json_response(200)

	assert [] = response
	end
	end

	describe "POST /api/favorites/create/:id" do
	setup [:valid_user]

	test "without valid credentials", %{conn: conn} do
	note_activity = insert(:note_activity)
	conn = post(conn, "/api/favorites/create/#{note_activity.id}.json")
	assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
	end

	test "with credentials", %{conn: conn, user: current_user} do
	note_activity = insert(:note_activity)

	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> post("/api/favorites/create/#{note_activity.id}.json")

	assert json_response(conn, 200)
	end

	test "with credentials, invalid param", %{conn: conn, user: current_user} do
	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> post("/api/favorites/create/wrong.json")

	assert json_response(conn, 400)
	end

	test "with credentials, invalid activity", %{conn: conn, user: current_user} do
	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> post("/api/favorites/create/1.json")

	assert json_response(conn, 400)
	end
	end

	describe "POST /api/favorites/destroy/:id" do
	setup [:valid_user]

	test "without valid credentials", %{conn: conn} do
	note_activity = insert(:note_activity)
	conn = post(conn, "/api/favorites/destroy/#{note_activity.id}.json")
	assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
	end

	test "with credentials", %{conn: conn, user: current_user} do
	note_activity = insert(:note_activity)
	object = Object.get_by_ap_id(note_activity.data["object"]["id"])
	ActivityPub.like(current_user, object)

	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> post("/api/favorites/destroy/#{note_activity.id}.json")

	assert json_response(conn, 200)
	end
	end

	describe "POST /api/statuses/retweet/:id" do
	setup [:valid_user]

	test "without valid credentials", %{conn: conn} do
	note_activity = insert(:note_activity)
	conn = post(conn, "/api/statuses/retweet/#{note_activity.id}.json")
	assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
	end

	test "with credentials", %{conn: conn, user: current_user} do
	note_activity = insert(:note_activity)

	request_path = "/api/statuses/retweet/#{note_activity.id}.json"

	response =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> post(request_path)

	activity = Activity.get_by_id(note_activity.id)
	activity_user = User.get_cached_by_ap_id(note_activity.data["actor"])

	assert json_response(response, 200) ==
	ActivityView.render("activity.json", %{
	user: activity_user,
	for: current_user,
	activity: activity
	})
	end
	end

	describe "POST /api/statuses/unretweet/:id" do
	setup [:valid_user]

	test "without valid credentials", %{conn: conn} do
	note_activity = insert(:note_activity)
	conn = post(conn, "/api/statuses/unretweet/#{note_activity.id}.json")
	assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
	end

	test "with credentials", %{conn: conn, user: current_user} do
	note_activity = insert(:note_activity)

	request_path = "/api/statuses/retweet/#{note_activity.id}.json"

	_response =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> post(request_path)

	request_path = String.replace(request_path, "retweet", "unretweet")

	response =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> post(request_path)

	activity = Activity.get_by_id(note_activity.id)
	activity_user = User.get_cached_by_ap_id(note_activity.data["actor"])

	assert json_response(response, 200) ==
	ActivityView.render("activity.json", %{
	user: activity_user,
	for: current_user,
	activity: activity
	})
	end
	end

	describe "POST /api/account/register" do
	test "it creates a new user", %{conn: conn} do
	data = %{
	"nickname" => "lain",
	"email" => "lain@wired.jp",
	"fullname" => "lain iwakura",
	"bio" => "close the world.",
	"password" => "bear",
	"confirm" => "bear"
	}

	conn =
	conn
	\|> post("/api/account/register", data)

	user = json_response(conn, 200)

	fetched_user = User.get_cached_by_nickname("lain")
	assert user == UserView.render("show.json", %{user: fetched_user})
	end

	test "it returns errors on a problem", %{conn: conn} do
	data = %{
	"email" => "lain@wired.jp",
	"fullname" => "lain iwakura",
	"bio" => "close the world.",
	"password" => "bear",
	"confirm" => "bear"
	}

	conn =
	conn
	\|> post("/api/account/register", data)

	errors = json_response(conn, 400)

	assert is_binary(errors["error"])
	end
	end

	describe "POST /api/account/password_reset, with valid parameters" do
	setup %{conn: conn} do
	user = insert(:user)
	conn = post(conn, "/api/account/password_reset?email=#{user.email}")
	%{conn: conn, user: user}
	end

	test "it returns 204", %{conn: conn} do
	assert json_response(conn, :no_content)
	end

	test "it creates a PasswordResetToken record for user", %{user: user} do
	token_record = Repo.get_by(Pleroma.PasswordResetToken, user_id: user.id)
	assert token_record
	end

	test "it sends an email to user", %{user: user} do
	token_record = Repo.get_by(Pleroma.PasswordResetToken, user_id: user.id)

	email = Pleroma.Emails.UserEmail.password_reset_email(user, token_record.token)
	notify_email = Pleroma.Config.get([:instance, :notify_email])
	instance_name = Pleroma.Config.get([:instance, :name])

	assert_email_sent(
	from: {instance_name, notify_email},
	to: {user.name, user.email},
	html_body: email.html_body
	)
	end
	end

	describe "POST /api/account/password_reset, with invalid parameters" do
	setup [:valid_user]

	test "it returns 500 when user is not found", %{conn: conn, user: user} do
	conn = post(conn, "/api/account/password_reset?email=nonexisting_#{user.email}")
	assert json_response(conn, :internal_server_error)
	end

	test "it returns 500 when user is not local", %{conn: conn, user: user} do
	{:ok, user} = Repo.update(Changeset.change(user, local: false))
	conn = post(conn, "/api/account/password_reset?email=#{user.email}")
	assert json_response(conn, :internal_server_error)
	end
	end

	describe "GET /api/account/confirm_email/:id/:token" do
	setup do
	user = insert(:user)
	info_change = User.Info.confirmation_changeset(user.info, need_confirmation: true)

	{:ok, user} =
	user
	\|> Changeset.change()
	\|> Changeset.put_embed(:info, info_change)
	\|> Repo.update()

	assert user.info.confirmation_pending

	[user: user]
	end

	test "it redirects to root url", %{conn: conn, user: user} do
	conn = get(conn, "/api/account/confirm_email/#{user.id}/#{user.info.confirmation_token}")

	assert 302 == conn.status
	end

	test "it confirms the user account", %{conn: conn, user: user} do
	get(conn, "/api/account/confirm_email/#{user.id}/#{user.info.confirmation_token}")

	user = User.get_cached_by_id(user.id)

	refute user.info.confirmation_pending
	refute user.info.confirmation_token
	end

	test "it returns 500 if user cannot be found by id", %{conn: conn, user: user} do
	conn = get(conn, "/api/account/confirm_email/0/#{user.info.confirmation_token}")

	assert 500 == conn.status
	end

	test "it returns 500 if token is invalid", %{conn: conn, user: user} do
	conn = get(conn, "/api/account/confirm_email/#{user.id}/wrong_token")

	assert 500 == conn.status
	end
	end

	describe "POST /api/account/resend_confirmation_email" do
	setup do
	setting = Pleroma.Config.get([:instance, :account_activation_required])

	unless setting do
	Pleroma.Config.put([:instance, :account_activation_required], true)
	on_exit(fn -> Pleroma.Config.put([:instance, :account_activation_required], setting) end)
	end

	user = insert(:user)
	info_change = User.Info.confirmation_changeset(user.info, need_confirmation: true)

	{:ok, user} =
	user
	\|> Changeset.change()
	\|> Changeset.put_embed(:info, info_change)
	\|> Repo.update()

	assert user.info.confirmation_pending

	[user: user]
	end

	test "it returns 204 No Content", %{conn: conn, user: user} do
	conn
	\|> assign(:user, user)
	\|> post("/api/account/resend_confirmation_email?email=#{user.email}")
	\|> json_response(:no_content)
	end

	test "it sends confirmation email", %{conn: conn, user: user} do
	conn
	\|> assign(:user, user)
	\|> post("/api/account/resend_confirmation_email?email=#{user.email}")

	email = Pleroma.Emails.UserEmail.account_confirmation_email(user)
	notify_email = Pleroma.Config.get([:instance, :notify_email])
	instance_name = Pleroma.Config.get([:instance, :name])

	assert_email_sent(
	from: {instance_name, notify_email},
	to: {user.name, user.email},
	html_body: email.html_body
	)
	end
	end

	describe "GET /api/externalprofile/show" do
	test "it returns the user", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/externalprofile/show", %{profileurl: other_user.ap_id})

	assert json_response(conn, 200) == UserView.render("show.json", %{user: other_user})
	end
	end

	describe "GET /api/statuses/followers" do
	test "it returns a user's followers", %{conn: conn} do
	user = insert(:user)
	follower_one = insert(:user)
	follower_two = insert(:user)
	_not_follower = insert(:user)

	{:ok, follower_one} = User.follow(follower_one, user)
	{:ok, follower_two} = User.follow(follower_two, user)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/statuses/followers")

	expected = UserView.render("index.json", %{users: [follower_one, follower_two], for: user})
	result = json_response(conn, 200)
	assert Enum.sort(expected) == Enum.sort(result)
	end

	test "it returns 20 followers per page", %{conn: conn} do
	user = insert(:user)
	followers = insert_list(21, :user)

	Enum.each(followers, fn follower ->
	User.follow(follower, user)
	end)

	res_conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/statuses/followers")

	result = json_response(res_conn, 200)
	assert length(result) == 20

	res_conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/statuses/followers?page=2")

	result = json_response(res_conn, 200)
	assert length(result) == 1
	end

	test "it returns a given user's followers with user_id", %{conn: conn} do
	user = insert(:user)
	follower_one = insert(:user)
	follower_two = insert(:user)
	not_follower = insert(:user)

	{:ok, follower_one} = User.follow(follower_one, user)
	{:ok, follower_two} = User.follow(follower_two, user)

	conn =
	conn
	\|> assign(:user, not_follower)
	\|> get("/api/statuses/followers", %{"user_id" => user.id})

	assert MapSet.equal?(
	MapSet.new(json_response(conn, 200)),
	MapSet.new(
	UserView.render("index.json", %{
	users: [follower_one, follower_two],
	for: not_follower
	})
	)
	)
	end

	test "it returns empty when hide_followers is set to true", %{conn: conn} do
	user = insert(:user, %{info: %{hide_followers: true}})
	follower_one = insert(:user)
	follower_two = insert(:user)
	not_follower = insert(:user)

	{:ok, _follower_one} = User.follow(follower_one, user)
	{:ok, _follower_two} = User.follow(follower_two, user)

	response =
	conn
	\|> assign(:user, not_follower)
	\|> get("/api/statuses/followers", %{"user_id" => user.id})
	\|> json_response(200)

	assert [] == response
	end

	test "it returns the followers when hide_followers is set to true if requested by the user themselves",
	%{
	conn: conn
	} do
	user = insert(:user, %{info: %{hide_followers: true}})
	follower_one = insert(:user)
	follower_two = insert(:user)
	_not_follower = insert(:user)

	{:ok, _follower_one} = User.follow(follower_one, user)
	{:ok, _follower_two} = User.follow(follower_two, user)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/statuses/followers", %{"user_id" => user.id})

	refute [] == json_response(conn, 200)
	end
	end

	describe "GET /api/statuses/blocks" do
	test "it returns the list of users blocked by requester", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, user} = User.block(user, other_user)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/statuses/blocks")

	expected = UserView.render("index.json", %{users: [other_user], for: user})
	result = json_response(conn, 200)
	assert Enum.sort(expected) == Enum.sort(result)
	end
	end

	describe "GET /api/statuses/friends" do
	test "it returns the logged in user's friends", %{conn: conn} do
	user = insert(:user)
	followed_one = insert(:user)
	followed_two = insert(:user)
	_not_followed = insert(:user)

	{:ok, user} = User.follow(user, followed_one)
	{:ok, user} = User.follow(user, followed_two)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/statuses/friends")

	expected = UserView.render("index.json", %{users: [followed_one, followed_two], for: user})
	result = json_response(conn, 200)
	assert Enum.sort(expected) == Enum.sort(result)
	end

	test "it returns 20 friends per page, except if 'export' is set to true", %{conn: conn} do
	user = insert(:user)
	followeds = insert_list(21, :user)

	{:ok, user} =
	Enum.reduce(followeds, {:ok, user}, fn followed, {:ok, user} ->
	User.follow(user, followed)
	end)

	res_conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/statuses/friends")

	result = json_response(res_conn, 200)
	assert length(result) == 20

	res_conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/statuses/friends", %{page: 2})

	result = json_response(res_conn, 200)
	assert length(result) == 1

	res_conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/statuses/friends", %{all: true})

	result = json_response(res_conn, 200)
	assert length(result) == 21
	end

	test "it returns a given user's friends with user_id", %{conn: conn} do
	user = insert(:user)
	followed_one = insert(:user)
	followed_two = insert(:user)
	_not_followed = insert(:user)

	{:ok, user} = User.follow(user, followed_one)
	{:ok, user} = User.follow(user, followed_two)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/statuses/friends", %{"user_id" => user.id})

	assert MapSet.equal?(
	MapSet.new(json_response(conn, 200)),
	MapSet.new(
	UserView.render("index.json", %{users: [followed_one, followed_two], for: user})
	)
	)
	end

	test "it returns empty when hide_follows is set to true", %{conn: conn} do
	user = insert(:user, %{info: %{hide_follows: true}})
	followed_one = insert(:user)
	followed_two = insert(:user)
	not_followed = insert(:user)

	{:ok, user} = User.follow(user, followed_one)
	{:ok, user} = User.follow(user, followed_two)

	conn =
	conn
	\|> assign(:user, not_followed)
	\|> get("/api/statuses/friends", %{"user_id" => user.id})

	assert [] == json_response(conn, 200)
	end

	test "it returns friends when hide_follows is set to true if the user themselves request it",
	%{
	conn: conn
	} do
	user = insert(:user, %{info: %{hide_follows: true}})
	followed_one = insert(:user)
	followed_two = insert(:user)
	_not_followed = insert(:user)

	{:ok, _user} = User.follow(user, followed_one)
	{:ok, _user} = User.follow(user, followed_two)

	response =
	conn
	\|> assign(:user, user)
	\|> get("/api/statuses/friends", %{"user_id" => user.id})
	\|> json_response(200)

	refute [] == response
	end

	test "it returns a given user's friends with screen_name", %{conn: conn} do
	user = insert(:user)
	followed_one = insert(:user)
	followed_two = insert(:user)
	_not_followed = insert(:user)

	{:ok, user} = User.follow(user, followed_one)
	{:ok, user} = User.follow(user, followed_two)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/statuses/friends", %{"screen_name" => user.nickname})

	assert MapSet.equal?(
	MapSet.new(json_response(conn, 200)),
	MapSet.new(
	UserView.render("index.json", %{users: [followed_one, followed_two], for: user})
	)
	)
	end
	end

	describe "GET /friends/ids" do
	test "it returns a user's friends", %{conn: conn} do
	user = insert(:user)
	followed_one = insert(:user)
	followed_two = insert(:user)
	_not_followed = insert(:user)

	{:ok, user} = User.follow(user, followed_one)
	{:ok, user} = User.follow(user, followed_two)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/friends/ids")

	expected = [followed_one.id, followed_two.id]

	assert MapSet.equal?(
	MapSet.new(Poison.decode!(json_response(conn, 200))),
	MapSet.new(expected)
	)
	end
	end

	describe "POST /api/account/update_profile.json" do
	test "it updates a user's profile", %{conn: conn} do
	user = insert(:user)
	user2 = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/account/update_profile.json", %{
	"name" => "new name",
	"description" => "hi @#{user2.nickname}"
	})

	user = Repo.get!(User, user.id)
	assert user.name == "new name"

	assert user.bio ==
	"hi <span class='h-card'><a data-user='#{user2.id}' class='u-url mention' href='#{
	user2.ap_id
	}'>@<span>#{user2.nickname}</span></a></span>"

	assert json_response(conn, 200) == UserView.render("user.json", %{user: user, for: user})
	end

	test "it sets and un-sets hide_follows", %{conn: conn} do
	user = insert(:user)

	conn
	\|> assign(:user, user)
	\|> post("/api/account/update_profile.json", %{
	"hide_follows" => "true"
	})

	user = Repo.get!(User, user.id)
	assert user.info.hide_follows == true

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/account/update_profile.json", %{
	"hide_follows" => "false"
	})

	user = Repo.get!(User, user.id)
	assert user.info.hide_follows == false
	assert json_response(conn, 200) == UserView.render("user.json", %{user: user, for: user})
	end

	test "it sets and un-sets hide_followers", %{conn: conn} do
	user = insert(:user)

	conn
	\|> assign(:user, user)
	\|> post("/api/account/update_profile.json", %{
	"hide_followers" => "true"
	})

	user = Repo.get!(User, user.id)
	assert user.info.hide_followers == true

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/account/update_profile.json", %{
	"hide_followers" => "false"
	})

	user = Repo.get!(User, user.id)
	assert user.info.hide_followers == false
	assert json_response(conn, 200) == UserView.render("user.json", %{user: user, for: user})
	end

	test "it sets and un-sets show_role", %{conn: conn} do
	user = insert(:user)

	conn
	\|> assign(:user, user)
	\|> post("/api/account/update_profile.json", %{
	"show_role" => "true"
	})

	user = Repo.get!(User, user.id)
	assert user.info.show_role == true

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/account/update_profile.json", %{
	"show_role" => "false"
	})

	user = Repo.get!(User, user.id)
	assert user.info.show_role == false
	assert json_response(conn, 200) == UserView.render("user.json", %{user: user, for: user})
	end

	test "it locks an account", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/account/update_profile.json", %{
	"locked" => "true"
	})

	user = Repo.get!(User, user.id)
	assert user.info.locked == true

	assert json_response(conn, 200) == UserView.render("user.json", %{user: user, for: user})
	end

	test "it unlocks an account", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/account/update_profile.json", %{
	"locked" => "false"
	})

	user = Repo.get!(User, user.id)
	assert user.info.locked == false

	assert json_response(conn, 200) == UserView.render("user.json", %{user: user, for: user})
	end

	# Broken before the change to class="emoji" and non-<img/> in the DB
	@tag :skip
	test "it formats emojos", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/account/update_profile.json", %{
	"bio" => "I love our :moominmamma:"
	})

	assert response = json_response(conn, 200)

	assert %{
	"description" => "I love our :moominmamma:",
	"description_html" =>
	~s{I love our <img class="emoji" alt="moominmamma" title="moominmamma" src="} <>
	_
	} = response

	conn =
	conn
	\|> get("/api/users/show.json?user_id=#{user.nickname}")

	assert response == json_response(conn, 200)
	end
	end

	defp valid_user(_context) do
	user = insert(:user)
	[user: user]
	end

	defp with_credentials(conn, username, password) do
	header_content = "Basic " <> Base.encode64("#{username}:#{password}")
	put_req_header(conn, "authorization", header_content)
	end

	describe "GET /api/search.json" do
	test "it returns search results", %{conn: conn} do
	user = insert(:user)
	user_two = insert(:user, %{nickname: "shp@shitposter.club"})

	{:ok, activity} = CommonAPI.post(user, %{"status" => "This is about 2hu"})
	{:ok, _} = CommonAPI.post(user_two, %{"status" => "This isn't"})

	conn =
	conn
	\|> get("/api/search.json", %{"q" => "2hu", "page" => "1", "rpp" => "1"})

	assert [status] = json_response(conn, 200)
	assert status["id"] == activity.id
	end
	end

	describe "GET /api/statusnet/tags/timeline/:tag.json" do
	test "it returns the tags timeline", %{conn: conn} do
	user = insert(:user)
	user_two = insert(:user, %{nickname: "shp@shitposter.club"})

	{:ok, activity} = CommonAPI.post(user, %{"status" => "This is about #2hu"})
	{:ok, _} = CommonAPI.post(user_two, %{"status" => "This isn't"})

	conn =
	conn
	\|> get("/api/statusnet/tags/timeline/2hu.json")

	assert [status] = json_response(conn, 200)
	assert status["id"] == activity.id
	end
	end

	test "Convert newlines to <br> in bio", %{conn: conn} do
	user = insert(:user)

	_conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/account/update_profile.json", %{
	"description" => "Hello,\r\nWorld! I\n am a test."
	})

	user = Repo.get!(User, user.id)
	assert user.bio == "Hello,<br>World! I<br> am a test."
	end

	describe "POST /api/pleroma/change_password" do
	setup [:valid_user]

	test "without credentials", %{conn: conn} do
	conn = post(conn, "/api/pleroma/change_password")
	assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
	end

	test "with credentials and invalid password", %{conn: conn, user: current_user} do
	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> post("/api/pleroma/change_password", %{
	"password" => "hi",
	"new_password" => "newpass",
	"new_password_confirmation" => "newpass"
	})

	assert json_response(conn, 200) == %{"error" => "Invalid password."}
	end

	test "with credentials, valid password and new password and confirmation not matching", %{
	conn: conn,
	user: current_user
	} do
	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> post("/api/pleroma/change_password", %{
	"password" => "test",
	"new_password" => "newpass",
	"new_password_confirmation" => "notnewpass"
	})

	assert json_response(conn, 200) == %{
	"error" => "New password does not match confirmation."
	}
	end

	test "with credentials, valid password and invalid new password", %{
	conn: conn,
	user: current_user
	} do
	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> post("/api/pleroma/change_password", %{
	"password" => "test",
	"new_password" => "",
	"new_password_confirmation" => ""
	})

	assert json_response(conn, 200) == %{
	"error" => "New password can't be blank."
	}
	end

	test "with credentials, valid password and matching new password and confirmation", %{
	conn: conn,
	user: current_user
	} do
	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> post("/api/pleroma/change_password", %{
	"password" => "test",
	"new_password" => "newpass",
	"new_password_confirmation" => "newpass"
	})

	assert json_response(conn, 200) == %{"status" => "success"}
	fetched_user = User.get_cached_by_id(current_user.id)
	assert Pbkdf2.checkpw("newpass", fetched_user.password_hash) == true
	end
	end

	describe "POST /api/pleroma/delete_account" do
	setup [:valid_user]

	test "without credentials", %{conn: conn} do
	conn = post(conn, "/api/pleroma/delete_account")
	assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
	end

	test "with credentials and invalid password", %{conn: conn, user: current_user} do
	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> post("/api/pleroma/delete_account", %{"password" => "hi"})

	assert json_response(conn, 200) == %{"error" => "Invalid password."}
	end

	test "with credentials and valid password", %{conn: conn, user: current_user} do
	conn =
	conn
	\|> with_credentials(current_user.nickname, "test")
	\|> post("/api/pleroma/delete_account", %{"password" => "test"})

	assert json_response(conn, 200) == %{"status" => "success"}
	# Wait a second for the started task to end
	:timer.sleep(1000)
	end
	end

	describe "GET /api/pleroma/friend_requests" do
	test "it lists friend requests" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, _activity} = ActivityPub.follow(other_user, user)

	user = User.get_cached_by_id(user.id)
	other_user = User.get_cached_by_id(other_user.id)

	assert User.following?(other_user, user) == false

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> get("/api/pleroma/friend_requests")

	assert [relationship] = json_response(conn, 200)
	assert other_user.id == relationship["id"]
	end

	test "requires 'read' permission", %{conn: conn} do
	token1 = insert(:oauth_token, scopes: ["write"])
	token2 = insert(:oauth_token, scopes: ["read"])

	for token <- [token1, token2] do
	conn =
	conn
	\|> put_req_header("authorization", "Bearer #{token.token}")
	\|> get("/api/pleroma/friend_requests")

	if token == token1 do
	assert %{"error" => "Insufficient permissions: read."} == json_response(conn, 403)
	else
	assert json_response(conn, 200)
	end
	end
	end
	end

	describe "POST /api/pleroma/friendships/approve" do
	test "it approves a friend request" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, _activity} = ActivityPub.follow(other_user, user)

	user = User.get_cached_by_id(user.id)
	other_user = User.get_cached_by_id(other_user.id)

	assert User.following?(other_user, user) == false

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> post("/api/pleroma/friendships/approve", %{"user_id" => other_user.id})

	assert relationship = json_response(conn, 200)
	assert other_user.id == relationship["id"]
	assert relationship["follows_you"] == true
	end
	end

	describe "POST /api/pleroma/friendships/deny" do
	test "it denies a friend request" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, _activity} = ActivityPub.follow(other_user, user)

	user = User.get_cached_by_id(user.id)
	other_user = User.get_cached_by_id(other_user.id)

	assert User.following?(other_user, user) == false

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> post("/api/pleroma/friendships/deny", %{"user_id" => other_user.id})

	assert relationship = json_response(conn, 200)
	assert other_user.id == relationship["id"]
	assert relationship["follows_you"] == false
	end
	end

	describe "GET /api/pleroma/search_user" do
	test "it returns users, ordered by similarity", %{conn: conn} do
	user = insert(:user, %{name: "eal"})
	user_two = insert(:user, %{name: "eal me"})
	_user_three = insert(:user, %{name: "zzz"})

	resp =
	conn
	\|> get(twitter_api_search__path(conn, :search_user), query: "eal me")
	\|> json_response(200)

	assert length(resp) == 2
	assert [user_two.id, user.id] == Enum.map(resp, fn %{"id" => id} -> id end)
	end
	end

	describe "POST /api/media/upload" do
	setup context do
	Pleroma.DataCase.ensure_local_uploader(context)
	end

	test "it performs the upload and sets `data[actor]` with AP id of uploader user", %{
	conn: conn
	} do
	user = insert(:user)

	upload_filename = "test/fixtures/image_tmp.jpg"
	File.cp!("test/fixtures/image.jpg", upload_filename)

	file = %Plug.Upload{
	content_type: "image/jpg",
	path: Path.absname(upload_filename),
	filename: "image.jpg"
	}

	response =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/octet-stream")
	\|> post("/api/media/upload", %{
	"media" => file
	})
	\|> json_response(:ok)

	assert response["media_id"]
	object = Repo.get(Object, response["media_id"])
	assert object
	assert object.data["actor"] == User.ap_id(user)
	end
	end

	describe "POST /api/media/metadata/create" do
	setup do
	object = insert(:note)
	user = User.get_cached_by_ap_id(object.data["actor"])
	%{object: object, user: user}
	end

	test "it returns :forbidden status on attempt to modify someone else's upload", %{
	conn: conn,
	object: object
	} do
	initial_description = object.data["name"]
	another_user = insert(:user)

	conn
	\|> assign(:user, another_user)
	\|> post("/api/media/metadata/create", %{"media_id" => object.id})
	\|> json_response(:forbidden)

	object = Repo.get(Object, object.id)
	assert object.data["name"] == initial_description
	end

	test "it updates `data[name]` of referenced Object with provided value", %{
	conn: conn,
	object: object,
	user: user
	} do
	description = "Informative description of the image. Initial value: #{object.data["name"]}}"

	conn
	\|> assign(:user, user)
	\|> post("/api/media/metadata/create", %{
	"media_id" => object.id,
	"alt_text" => %{"text" => description}
	})
	\|> json_response(:no_content)

	object = Repo.get(Object, object.id)
	assert object.data["name"] == description
	end
	end

	describe "POST /api/statuses/user_timeline.json?user_id=:user_id&pinned=true" do
	test "it returns a list of pinned statuses", %{conn: conn} do
	Pleroma.Config.put([:instance, :max_pinned_statuses], 1)

	user = insert(:user, %{name: "egor"})
	{:ok, %{id: activity_id}} = CommonAPI.post(user, %{"status" => "HI!!!"})
	{:ok, _} = CommonAPI.pin(activity_id, user)

	resp =
	conn
	\|> get("/api/statuses/user_timeline.json", %{user_id: user.id, pinned: true})
	\|> json_response(200)

	assert length(resp) == 1
	assert [%{"id" => ^activity_id, "pinned" => true}] = resp
	end
	end

	describe "POST /api/statuses/pin/:id" do
	setup do
	Pleroma.Config.put([:instance, :max_pinned_statuses], 1)
	[user: insert(:user)]
	end

	test "without valid credentials", %{conn: conn} do
	note_activity = insert(:note_activity)
	conn = post(conn, "/api/statuses/pin/#{note_activity.id}.json")
	assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
	end

	test "with credentials", %{conn: conn, user: user} do
	{:ok, activity} = CommonAPI.post(user, %{"status" => "test!"})

	request_path = "/api/statuses/pin/#{activity.id}.json"

	response =
	conn
	\|> with_credentials(user.nickname, "test")
	\|> post(request_path)

	user = refresh_record(user)

	assert json_response(response, 200) ==
	ActivityView.render("activity.json", %{user: user, for: user, activity: activity})
	end
	end

	describe "POST /api/statuses/unpin/:id" do
	setup do
	Pleroma.Config.put([:instance, :max_pinned_statuses], 1)
	[user: insert(:user)]
	end

	test "without valid credentials", %{conn: conn} do
	note_activity = insert(:note_activity)
	conn = post(conn, "/api/statuses/unpin/#{note_activity.id}.json")
	assert json_response(conn, 403) == %{"error" => "Invalid credentials."}
	end

	test "with credentials", %{conn: conn, user: user} do
	{:ok, activity} = CommonAPI.post(user, %{"status" => "test!"})
	{:ok, activity} = CommonAPI.pin(activity.id, user)

	request_path = "/api/statuses/unpin/#{activity.id}.json"

	response =
	conn
	\|> with_credentials(user.nickname, "test")
	\|> post(request_path)

	user = refresh_record(user)

	assert json_response(response, 200) ==
	ActivityView.render("activity.json", %{user: user, for: user, activity: activity})
	end
	end

	describe "GET /api/oauth_tokens" do
	setup do
	token = insert(:oauth_token) \|> Repo.preload(:user)

	%{token: token}
	end

	test "renders list", %{token: token} do
	response =
	build_conn()
	\|> assign(:user, token.user)
	\|> get("/api/oauth_tokens")

	keys =
	json_response(response, 200)
	\|> hd()
	\|> Map.keys()

	assert keys -- ["id", "app_name", "valid_until"] == []
	end

	test "revoke token", %{token: token} do
	response =
	build_conn()
	\|> assign(:user, token.user)
	\|> delete("/api/oauth_tokens/#{token.id}")

	tokens = Token.get_user_tokens(token.user)

	assert tokens == []
	assert response.status == 201
	end
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Sat, Oct 31, 6:13 PM (18 h, 11 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1801652
Default Alt Text: (98 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions