Merge branch 'main' into glitch-soc/merge-upstream

Conflicts:
- `.github/workflows/build-image.yml`:
  Upstream entirely refactored this, while we changed the docker repository
  to upload to and disabled the “latest” tag.
  Applied the repository change to `.github/workflows/build-*.yml`, as well
  as disabling native ARMv64 builds.
- `README.md`:
  We have a completely different README.
  Kept ours.
- `app/views/admin/settings/shared/_links.html.haml`:
  Upstream refactored, we had an extra item.
  Refactored as upstream did.
- `spec/controllers/api/v1/timelines/public_controller_spec.rb`:
  Upstream deleted this file, to be replaced by a request spec at
  `spec/requests/api/v1/timelines/public_spec.rb`.
  We had an extra bit about enabling the public timelines because we have
  different defaults than upstream.
  Moved that bit to `spec/requests/api/v1/timelines/public_spec.rb`

spec/controllers/api/v1/bookmarks_controller_spec.rb

@@ -1,80 +0,0 @@
-# frozen_string_literal: true
-
-require 'rails_helper'
-
-RSpec.describe Api::V1::BookmarksController do
-  render_views
-
-  let(:user)  { Fabricate(:user) }
-  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read:bookmarks') }
-
-  describe 'GET #index' do
-    context 'without token' do
-      it 'returns http unauthorized' do
-        get :index
-        expect(response).to have_http_status 401
-      end
-    end
-
-    context 'with token' do
-      context 'without read scope' do
-        before do
-          allow(controller).to receive(:doorkeeper_token) do
-            Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: '')
-          end
-        end
-
-        it 'returns http forbidden' do
-          get :index
-          expect(response).to have_http_status 403
-        end
-      end
-
-      context 'without valid resource owner' do
-        before do
-          token = Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read')
-          user.destroy!
-
-          allow(controller).to receive(:doorkeeper_token) { token }
-        end
-
-        it 'returns http unprocessable entity' do
-          get :index
-          expect(response).to have_http_status 422
-        end
-      end
-
-      context 'with read scope and valid resource owner' do
-        before do
-          allow(controller).to receive(:doorkeeper_token) do
-            Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read')
-          end
-        end
-
-        it 'shows bookmarks owned by the user' do
-          bookmarked_by_user = Fabricate(:bookmark, account: user.account)
-          bookmarked_by_others = Fabricate(:bookmark)
-
-          get :index
-
-          expect(assigns(:statuses)).to contain_exactly(bookmarked_by_user.status)
-        end
-
-        it 'adds pagination headers if necessary' do
-          bookmark = Fabricate(:bookmark, account: user.account)
-
-          get :index, params: { limit: 1 }
-
-          expect(response.headers['Link'].find_link(%w(rel next)).href).to eq "http://test.host/api/v1/bookmarks?limit=1&max_id=#{bookmark.id}"
-          expect(response.headers['Link'].find_link(%w(rel prev)).href).to eq "http://test.host/api/v1/bookmarks?limit=1&min_id=#{bookmark.id}"
-        end
-
-        it 'does not add pagination headers if not necessary' do
-          get :index
-
-          expect(response.headers['Link']).to be_nil
-        end
-      end
-    end
-  end
-end

spec/controllers/api/v1/mutes_controller_spec.rb

@@ -1,65 +0,0 @@
-# frozen_string_literal: true
-
-require 'rails_helper'
-
-RSpec.describe Api::V1::MutesController do
-  render_views
-
-  let(:user)   { Fabricate(:user) }
-  let(:scopes) { 'read:mutes' }
-  let(:token)  { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
-
-  before { allow(controller).to receive(:doorkeeper_token) { token } }
-
-  describe 'GET #index' do
-    it 'limits according to limit parameter' do
-      Array.new(2) { Fabricate(:mute, account: user.account) }
-      get :index, params: { limit: 1 }
-      expect(body_as_json.size).to eq 1
-    end
-
-    it 'queries mutes in range according to max_id' do
-      mutes = Array.new(2) { Fabricate(:mute, account: user.account) }
-
-      get :index, params: { max_id: mutes[1] }
-
-      expect(body_as_json.size).to eq 1
-      expect(body_as_json[0][:id]).to eq mutes[0].target_account_id.to_s
-    end
-
-    it 'queries mutes in range according to since_id' do
-      mutes = Array.new(2) { Fabricate(:mute, account: user.account) }
-
-      get :index, params: { since_id: mutes[0] }
-
-      expect(body_as_json.size).to eq 1
-      expect(body_as_json[0][:id]).to eq mutes[1].target_account_id.to_s
-    end
-
-    it 'sets pagination header for next path' do
-      mutes = Array.new(2) { Fabricate(:mute, account: user.account) }
-      get :index, params: { limit: 1, since_id: mutes[0] }
-      expect(response.headers['Link'].find_link(%w(rel next)).href).to eq api_v1_mutes_url(limit: 1, max_id: mutes[1])
-    end
-
-    it 'sets pagination header for previous path' do
-      mute = Fabricate(:mute, account: user.account)
-      get :index
-      expect(response.headers['Link'].find_link(%w(rel prev)).href).to eq api_v1_mutes_url(since_id: mute)
-    end
-
-    it 'returns http success' do
-      get :index
-      expect(response).to have_http_status(200)
-    end
-
-    context 'with wrong scopes' do
-      let(:scopes) { 'write:mutes' }
-
-      it 'returns http forbidden' do
-        get :index
-        expect(response).to have_http_status(403)
-      end
-    end
-  end
-end

spec/controllers/api/v1/timelines/public_controller_spec.rb

@@ -1,60 +0,0 @@
-# frozen_string_literal: true
-
-require 'rails_helper'
-
-describe Api::V1::Timelines::PublicController do
-  render_views
-
-  let(:user) { Fabricate(:user) }
-
-  before do
-    allow(controller).to receive(:doorkeeper_token) { token }
-  end
-
-  context 'with a user context' do
-    let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id) }
-
-    describe 'GET #show' do
-      before do
-        PostStatusService.new.call(user.account, text: 'New status from user for federated public timeline.')
-      end
-
-      it 'returns http success' do
-        get :show
-
-        expect(response).to have_http_status(200)
-        expect(response.headers['Link'].links.size).to eq(2)
-      end
-    end
-
-    describe 'GET #show with local only' do
-      before do
-        PostStatusService.new.call(user.account, text: 'New status from user for local public timeline.')
-      end
-
-      it 'returns http success' do
-        get :show, params: { local: true }
-
-        expect(response).to have_http_status(200)
-        expect(response.headers['Link'].links.size).to eq(2)
-      end
-    end
-  end
-
-  context 'without a user context' do
-    let(:token) { Fabricate(:accessible_access_token, resource_owner_id: nil) }
-
-    before do
-      Setting.timeline_preview = true
-    end
-
-    describe 'GET #show' do
-      it 'returns http success' do
-        get :show
-
-        expect(response).to have_http_status(200)
-        expect(response.headers['Link']).to be_nil
-      end
-    end
-  end
-end

spec/requests/api/v1/bookmarks_spec.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Bookmarks' do
+  let(:user)    { Fabricate(:user) }
+  let(:token)   { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
+  let(:scopes)  { 'read:bookmarks' }
+  let(:headers) { { 'Authorization' => "Bearer #{token.token}" } }
+
+  describe 'GET /api/v1/bookmarks' do
+    subject do
+      get '/api/v1/bookmarks', headers: headers, params: params
+    end
+
+    let(:params)     { {} }
+    let!(:bookmarks) { Fabricate.times(3, :bookmark, account: user.account) }
+
+    let(:expected_response) do
+      bookmarks.map do |bookmark|
+        a_hash_including(id: bookmark.status.id.to_s, account: a_hash_including(id: bookmark.status.account.id.to_s))
+      end
+    end
+
+    it_behaves_like 'forbidden for wrong scope', 'write'
+
+    it 'returns http success' do
+      subject
+
+      expect(response).to have_http_status(200)
+    end
+
+    it 'returns the bookmarked statuses' do
+      subject
+
+      expect(body_as_json).to match_array(expected_response)
+    end
+
+    context 'with limit param' do
+      let(:params) { { limit: 2 } }
+
+      it 'paginates correctly', :aggregate_failures do
+        subject
+
+        expect(body_as_json.size).to eq(params[:limit])
+        expect(response.headers['Link'].find_link(%w(rel prev)).href).to eq(api_v1_bookmarks_url(limit: params[:limit], min_id: bookmarks.last.id))
+        expect(response.headers['Link'].find_link(%w(rel next)).href).to eq(api_v1_bookmarks_url(limit: params[:limit], max_id: bookmarks[1].id))
+      end
+    end
+
+    context 'without the authorization header' do
+      let(:headers) { {} }
+
+      it 'returns http unauthorized' do
+        subject
+
+        expect(response).to have_http_status(401)
+      end
+    end
+  end
+end

spec/requests/api/v1/mutes_spec.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Mutes' do
+  let(:user)    { Fabricate(:user) }
+  let(:scopes)  { 'read:mutes' }
+  let(:token)   { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
+  let(:headers) { { 'Authorization' => "Bearer #{token.token}" } }
+
+  describe 'GET /api/v1/mutes' do
+    subject do
+      get '/api/v1/mutes', headers: headers, params: params
+    end
+
+    let!(:mutes) { Fabricate.times(3, :mute, account: user.account) }
+    let(:params) { {} }
+
+    it_behaves_like 'forbidden for wrong scope', 'write write:mutes'
+
+    it 'returns http success' do
+      subject
+
+      expect(response).to have_http_status(200)
+    end
+
+    it 'returns the muted accounts' do
+      subject
+
+      muted_accounts = mutes.map(&:target_account)
+
+      expect(body_as_json.pluck(:id)).to match_array(muted_accounts.map { |account| account.id.to_s })
+    end
+
+    context 'with limit param' do
+      let(:params) { { limit: 2 } }
+
+      it 'returns only the requested number of muted accounts' do
+        subject
+
+        expect(body_as_json.size).to eq(params[:limit])
+      end
+
+      it 'sets the correct pagination headers', :aggregate_failures do
+        subject
+
+        headers = response.headers['Link']
+
+        expect(headers.find_link(%w(rel prev)).href).to eq(api_v1_mutes_url(limit: params[:limit], since_id: mutes[2].id.to_s))
+        expect(headers.find_link(%w(rel next)).href).to eq(api_v1_mutes_url(limit: params[:limit], max_id: mutes[1].id.to_s))
+      end
+    end
+
+    context 'with max_id param' do
+      let(:params) { { max_id: mutes[1].id } }
+
+      it 'queries mutes in range according to max_id', :aggregate_failures do
+        subject
+
+        body = body_as_json
+
+        expect(body.size).to eq 1
+        expect(body[0][:id]).to eq mutes[0].target_account_id.to_s
+      end
+    end
+
+    context 'with since_id param' do
+      let(:params) { { since_id: mutes[0].id } }
+
+      it 'queries mutes in range according to since_id', :aggregate_failures do
+        subject
+
+        body = body_as_json
+
+        expect(body.size).to eq 2
+        expect(body[0][:id]).to eq mutes[2].target_account_id.to_s
+      end
+    end
+
+    context 'without an authentication header' do
+      let(:headers) { {} }
+
+      it 'returns http unauthorized' do
+        subject
+
+        expect(response).to have_http_status(401)
+      end
+    end
+  end
+end

spec/requests/api/v1/timelines/public_spec.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe 'Public' do
+  let(:user)    { Fabricate(:user) }
+  let(:scopes)  { 'read:statuses' }
+  let(:token)   { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
+  let(:headers) { { 'Authorization' => "Bearer #{token.token}" } }
+
+  shared_examples 'a successful request to the public timeline' do
+    it 'returns the expected statuses successfully', :aggregate_failures do
+      subject
+
+      expect(response).to have_http_status(200)
+      expect(body_as_json.pluck(:id)).to match_array(expected_statuses.map { |status| status.id.to_s })
+    end
+  end
+
+  describe 'GET /api/v1/timelines/public' do
+    subject do
+      get '/api/v1/timelines/public', headers: headers, params: params
+    end
+
+    let!(:private_status) { Fabricate(:status, visibility: :private) } # rubocop:disable RSpec/LetSetup
+    let!(:local_status)   { Fabricate(:status, account: Fabricate.build(:account, domain: nil)) }
+    let!(:remote_status)  { Fabricate(:status, account: Fabricate.build(:account, domain: 'example.com')) }
+    let!(:media_status)   { Fabricate(:status, media_attachments: [Fabricate.build(:media_attachment)]) }
+
+    let(:params) { {} }
+
+    context 'when the instance allows public preview' do
+      let(:expected_statuses) { [local_status, remote_status, media_status] }
+
+      before do
+        Setting.timeline_preview = true
+      end
+
+      context 'with an authorized user' do
+        it_behaves_like 'a successful request to the public timeline'
+      end
+
+      context 'with an anonymous user' do
+        let(:headers) { {} }
+
+        it_behaves_like 'a successful request to the public timeline'
+      end
+
+      context 'with local param' do
+        let(:params) { { local: true } }
+        let(:expected_statuses) { [local_status, media_status] }
+
+        it_behaves_like 'a successful request to the public timeline'
+      end
+
+      context 'with remote param' do
+        let(:params) { { remote: true } }
+        let(:expected_statuses) { [remote_status] }
+
+        it_behaves_like 'a successful request to the public timeline'
+      end
+
+      context 'with only_media param' do
+        let(:params) { { only_media: true } }
+        let(:expected_statuses) { [media_status] }
+
+        it_behaves_like 'a successful request to the public timeline'
+      end
+
+      context 'with limit param' do
+        let(:params) { { limit: 1 } }
+
+        it 'returns only the requested number of statuses', :aggregate_failures do
+          subject
+
+          expect(response).to have_http_status(200)
+          expect(body_as_json.size).to eq(params[:limit])
+        end
+
+        it 'sets the correct pagination headers', :aggregate_failures do
+          subject
+
+          headers = response.headers['Link']
+
+          expect(headers.find_link(%w(rel prev)).href).to eq(api_v1_timelines_public_url(limit: 1, min_id: media_status.id.to_s))
+          expect(headers.find_link(%w(rel next)).href).to eq(api_v1_timelines_public_url(limit: 1, max_id: media_status.id.to_s))
+        end
+      end
+    end
+
+    context 'when the instance does not allow public preview' do
+      before do
+        Form::AdminSettings.new(timeline_preview: false).save
+      end
+
+      context 'with an authenticated user' do
+        let(:expected_statuses) { [local_status, remote_status, media_status] }
+
+        it_behaves_like 'a successful request to the public timeline'
+      end
+
+      context 'with an unauthenticated user' do
+        let(:headers) { {} }
+
+        it 'returns http unprocessable entity' do
+          subject
+
+          expect(response).to have_http_status(422)
+        end
+      end
+    end
+  end
+end