Merge commit '1814990a3d117555153321216fa593e4d9e84de3' into glitch-soc/merge-upstream

2023-07-30 15:54:34 +02:00
parent 450f75b6f7 1814990a3d
commit 454d8567d4
259 changed files with 1455 additions and 1989 deletions
--- a/spec/controllers/api/v2/filters_controller_spec.rb
+++ b/spec/controllers/api/v2/filters_controller_spec.rb
@ -1,123 +0,0 @@
-# frozen_string_literal: true
-
-require 'rails_helper'
-
-RSpec.describe Api::V2::FiltersController do
-  render_views
-
-  let(:user)  { Fabricate(:user) }
-  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
-
-  before do
-    allow(controller).to receive(:doorkeeper_token) { token }
-  end
-
-  describe 'GET #index' do
-    let(:scopes) { 'read:filters' }
-    let!(:filter) { Fabricate(:custom_filter, account: user.account) }
-
-    it 'returns http success' do
-      get :index
-      expect(response).to have_http_status(200)
-    end
-  end
-
-  describe 'POST #create' do
-    let(:scopes) { 'write:filters' }
-
-    before do
-      post :create, params: { title: 'magic', context: %w(home), filter_action: 'hide', keywords_attributes: [keyword: 'magic'] }
-    end
-
-    it 'returns http success' do
-      expect(response).to have_http_status(200)
-    end
-
-    it 'returns a filter with keywords' do
-      json = body_as_json
-      expect(json[:title]).to eq 'magic'
-      expect(json[:filter_action]).to eq 'hide'
-      expect(json[:context]).to eq ['home']
-      expect(json[:keywords].map { |keyword| keyword.slice(:keyword, :whole_word) }).to eq [{ keyword: 'magic', whole_word: true }]
-    end
-
-    it 'creates a filter' do
-      filter = user.account.custom_filters.first
-      expect(filter).to_not be_nil
-      expect(filter.keywords.pluck(:keyword)).to eq ['magic']
-      expect(filter.context).to eq %w(home)
-      expect(filter.irreversible?).to be true
-      expect(filter.expires_at).to be_nil
-    end
-  end
-
-  describe 'GET #show' do
-    let(:scopes)  { 'read:filters' }
-    let(:filter)  { Fabricate(:custom_filter, account: user.account) }
-
-    it 'returns http success' do
-      get :show, params: { id: filter.id }
-      expect(response).to have_http_status(200)
-    end
-  end
-
-  describe 'PUT #update' do
-    let(:scopes)   { 'write:filters' }
-    let!(:filter)  { Fabricate(:custom_filter, account: user.account) }
-    let!(:keyword) { Fabricate(:custom_filter_keyword, custom_filter: filter) }
-
-    context 'when updating filter parameters' do
-      before do
-        put :update, params: { id: filter.id, title: 'updated', context: %w(home public) }
-      end
-
-      it 'returns http success' do
-        expect(response).to have_http_status(200)
-      end
-
-      it 'updates the filter title' do
-        expect(filter.reload.title).to eq 'updated'
-      end
-
-      it 'updates the filter context' do
-        expect(filter.reload.context).to eq %w(home public)
-      end
-    end
-
-    context 'when updating keywords in bulk' do
-      before do
-        allow(redis).to receive_messages(publish: nil)
-        put :update, params: { id: filter.id, keywords_attributes: [{ id: keyword.id, keyword: 'updated' }] }
-      end
-
-      it 'returns http success' do
-        expect(response).to have_http_status(200)
-      end
-
-      it 'updates the keyword' do
-        expect(keyword.reload.keyword).to eq 'updated'
-      end
-
-      it 'sends exactly one filters_changed event' do
-        expect(redis).to have_received(:publish).with("timeline:#{user.account.id}", Oj.dump(event: :filters_changed)).once
-      end
-    end
-  end
-
-  describe 'DELETE #destroy' do
-    let(:scopes)  { 'write:filters' }
-    let(:filter)  { Fabricate(:custom_filter, account: user.account) }
-
-    before do
-      delete :destroy, params: { id: filter.id }
-    end
-
-    it 'returns http success' do
-      expect(response).to have_http_status(200)
-    end
-
-    it 'removes the filter' do
-      expect { filter.reload }.to raise_error ActiveRecord::RecordNotFound
-    end
-  end
-end
--- a/spec/controllers/concerns/account_controller_concern_spec.rb
+++ b/spec/controllers/concerns/account_controller_concern_spec.rb
@ -2,8 +2,8 @@

 require 'rails_helper'

-describe ApplicationController do
-  controller do
+describe AccountControllerConcern do
+  controller(ApplicationController) do
    include AccountControllerConcern

    def success
--- a/spec/controllers/concerns/export_controller_concern_spec.rb
+++ b/spec/controllers/concerns/export_controller_concern_spec.rb
@ -2,8 +2,8 @@

 require 'rails_helper'

-describe ApplicationController do
-  controller do
+describe ExportControllerConcern do
+  controller(ApplicationController) do
    include ExportControllerConcern

    def index
--- a/spec/controllers/concerns/localized_spec.rb
+++ b/spec/controllers/concerns/localized_spec.rb
@ -2,8 +2,8 @@

 require 'rails_helper'

-describe ApplicationController do
-  controller do
+describe Localized do
+  controller(ApplicationController) do
    include Localized

    def success
--- a/spec/controllers/concerns/rate_limit_headers_spec.rb
+++ b/spec/controllers/concerns/rate_limit_headers_spec.rb
@ -2,8 +2,8 @@

 require 'rails_helper'

-describe ApplicationController do
-  controller do
+describe RateLimitHeaders do
+  controller(ApplicationController) do
    include RateLimitHeaders

    def show
--- a/spec/controllers/concerns/signature_verification_spec.rb
+++ b/spec/controllers/concerns/signature_verification_spec.rb
@ -2,7 +2,7 @@

 require 'rails_helper'

-describe ApplicationController do
+describe SignatureVerification do
  let(:wrapped_actor_class) do
    Class.new do
      attr_reader :wrapped_account
@ -15,7 +15,7 @@ describe ApplicationController do
    end
  end

-  controller do
+  controller(ApplicationController) do
    include SignatureVerification

    before_action :require_actor_signature!, only: [:signature_required]
--- a/spec/controllers/concerns/user_tracking_concern_spec.rb
+++ b/spec/controllers/concerns/user_tracking_concern_spec.rb
@ -2,8 +2,8 @@

 require 'rails_helper'

-describe ApplicationController do
-  controller do
+describe UserTrackingConcern do
+  controller(ApplicationController) do
    include UserTrackingConcern

    def show
--- a/spec/requests/api/v2/filters/filters_spec.rb
+++ b/spec/requests/api/v2/filters/filters_spec.rb
@ -0,0 +1,248 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Filters' do
+  let(:user)    { Fabricate(:user) }
+  let(:scopes)  { 'read:filters write:filters' }
+  let(:token)   { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
+  let(:headers) { { 'Authorization' => "Bearer #{token.token}" } }
+
+  shared_examples 'unauthorized for invalid token' do
+    let(:headers) { { 'Authorization' => '' } }
+
+    it 'returns http unauthorized' do
+      subject
+
+      expect(response).to have_http_status(401)
+    end
+  end
+
+  describe 'GET /api/v2/filters' do
+    subject do
+      get '/api/v2/filters', headers: headers
+    end
+
+    let!(:filters) { Fabricate.times(3, :custom_filter, account: user.account) }
+
+    it_behaves_like 'forbidden for wrong scope', 'write write:filters'
+    it_behaves_like 'unauthorized for invalid token'
+
+    it 'returns the existing filters successfully', :aggregate_failures do
+      subject
+
+      expect(response).to have_http_status(200)
+      expect(body_as_json.pluck(:id)).to match_array(filters.map { |filter| filter.id.to_s })
+    end
+  end
+
+  describe 'POST /api/v2/filters' do
+    subject do
+      post '/api/v2/filters', params: params, headers: headers
+    end
+
+    let(:params) { {} }
+
+    it_behaves_like 'forbidden for wrong scope', 'read read:filters'
+    it_behaves_like 'unauthorized for invalid token'
+
+    context 'with valid params' do
+      let(:params) { { title: 'magic', context: %w(home), filter_action: 'hide', keywords_attributes: [keyword: 'magic'] } }
+
+      it 'returns http success' do
+        subject
+
+        expect(response).to have_http_status(200)
+      end
+
+      it 'returns a filter with keywords', :aggregate_failures do
+        subject
+
+        json = body_as_json
+
+        expect(json[:title]).to eq 'magic'
+        expect(json[:filter_action]).to eq 'hide'
+        expect(json[:context]).to eq ['home']
+        expect(json[:keywords].map { |keyword| keyword.slice(:keyword, :whole_word) }).to eq [{ keyword: 'magic', whole_word: true }]
+      end
+
+      it 'creates a filter', :aggregate_failures do
+        subject
+
+        filter = user.account.custom_filters.first
+
+        expect(filter).to be_present
+        expect(filter.keywords.pluck(:keyword)).to eq ['magic']
+        expect(filter.context).to eq %w(home)
+        expect(filter.irreversible?).to be true
+        expect(filter.expires_at).to be_nil
+      end
+    end
+
+    context 'when the required title param is missing' do
+      let(:params) { { context: %w(home), filter_action: 'hide', keywords_attributes: [keyword: 'magic'] } }
+
+      it 'returns http unprocessable entity' do
+        subject
+
+        expect(response).to have_http_status(422)
+      end
+    end
+
+    context 'when the required context param is missing' do
+      let(:params) { { title: 'magic', filter_action: 'hide', keywords_attributes: [keyword: 'magic'] } }
+
+      it 'returns http unprocessable entity' do
+        subject
+
+        expect(response).to have_http_status(422)
+      end
+    end
+
+    context 'when the given context value is invalid' do
+      let(:params) { { title: 'magic', context: %w(shaolin), filter_action: 'hide', keywords_attributes: [keyword: 'magic'] } }
+
+      it 'returns http unprocessable entity' do
+        subject
+
+        expect(response).to have_http_status(422)
+      end
+    end
+  end
+
+  describe 'GET /api/v2/filters/:id' do
+    subject do
+      get "/api/v2/filters/#{filter.id}", headers: headers
+    end
+
+    let(:filter) { Fabricate(:custom_filter, account: user.account) }
+
+    it_behaves_like 'forbidden for wrong scope', 'write write:filters'
+    it_behaves_like 'unauthorized for invalid token'
+
+    it 'returns the filter successfully', :aggregate_failures do
+      subject
+
+      expect(response).to have_http_status(200)
+      expect(body_as_json[:id]).to eq(filter.id.to_s)
+    end
+
+    context 'when the filter belongs to someone else' do
+      let(:filter) { Fabricate(:custom_filter) }
+
+      it 'returns http not found' do
+        subject
+
+        expect(response).to have_http_status(404)
+      end
+    end
+  end
+
+  describe 'PUT /api/v2/filters/:id' do
+    subject do
+      put "/api/v2/filters/#{filter.id}", params: params, headers: headers
+    end
+
+    let!(:filter)  { Fabricate(:custom_filter, account: user.account) }
+    let!(:keyword) { Fabricate(:custom_filter_keyword, custom_filter: filter) }
+    let(:params)   { {} }
+
+    it_behaves_like 'forbidden for wrong scope', 'read read:filters'
+    it_behaves_like 'unauthorized for invalid token'
+
+    context 'when updating filter parameters' do
+      context 'with valid params' do
+        let(:params) { { title: 'updated', context: %w(home public) } }
+
+        it 'updates the filter successfully', :aggregate_failures do
+          subject
+
+          filter.reload
+
+          expect(response).to have_http_status(200)
+          expect(filter.title).to eq 'updated'
+          expect(filter.reload.context).to eq %w(home public)
+        end
+      end
+
+      context 'with invalid params' do
+        let(:params) { { title: 'updated', context: %w(word) } }
+
+        it 'returns http unprocessable entity' do
+          subject
+
+          expect(response).to have_http_status(422)
+        end
+      end
+    end
+
+    context 'when updating keywords in bulk' do
+      let(:params) { { keywords_attributes: [{ id: keyword.id, keyword: 'updated' }] } }
+
+      before do
+        allow(redis).to receive_messages(publish: nil)
+      end
+
+      it 'returns http success' do
+        subject
+
+        expect(response).to have_http_status(200)
+      end
+
+      it 'updates the keyword' do
+        subject
+
+        expect(keyword.reload.keyword).to eq 'updated'
+      end
+
+      it 'sends exactly one filters_changed event' do
+        subject
+
+        expect(redis).to have_received(:publish).with("timeline:#{user.account.id}", Oj.dump(event: :filters_changed)).once
+      end
+    end
+
+    context 'when the filter belongs to someone else' do
+      let(:filter) { Fabricate(:custom_filter) }
+
+      it 'returns http not found' do
+        subject
+
+        expect(response).to have_http_status(404)
+      end
+    end
+  end
+
+  describe 'DELETE /api/v2/filters/:id' do
+    subject do
+      delete "/api/v2/filters/#{filter.id}", headers: headers
+    end
+
+    let(:filter) { Fabricate(:custom_filter, account: user.account) }
+
+    it_behaves_like 'forbidden for wrong scope', 'read read:filters'
+    it_behaves_like 'unauthorized for invalid token'
+
+    it 'returns http success' do
+      subject
+
+      expect(response).to have_http_status(200)
+    end
+
+    it 'removes the filter' do
+      subject
+
+      expect { filter.reload }.to raise_error ActiveRecord::RecordNotFound
+    end
+
+    context 'when the filter belongs to someone else' do
+      let(:filter) { Fabricate(:custom_filter) }
+
+      it 'returns http not found' do
+        subject
+
+        expect(response).to have_http_status(404)
+      end
+    end
+  end
+end
--- a/spec/services/activitypub/fetch_remote_key_service_spec.rb
+++ b/spec/services/activitypub/fetch_remote_key_service_spec.rb
@ -8,7 +8,17 @@ RSpec.describe ActivityPub::FetchRemoteKeyService, type: :service do
  let(:webfinger) { { subject: 'acct:alice@example.com', links: [{ rel: 'self', href: 'https://example.com/alice' }] } }

  let(:public_key_pem) do
-    "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu3L4vnpNLzVH31MeWI39\n4F0wKeJFsLDAsNXGeOu0QF2x+h1zLWZw/agqD2R3JPU9/kaDJGPIV2Sn5zLyUA9S\n6swCCMOtn7BBR9g9sucgXJmUFB0tACH2QSgHywMAybGfmSb3LsEMNKsGJ9VsvYoh\n8lDET6X4Pyw+ZJU0/OLo/41q9w+OrGtlsTm/PuPIeXnxa6BLqnDaxC+4IcjG/FiP\nahNCTINl/1F/TgSSDZ4Taf4U9XFEIFw8wmgploELozzIzKq+t8nhQYkgAkt64euW\npva3qL5KD1mTIZQEP+LZvh3s2WHrLi3fhbdRuwQ2c0KkJA2oSTFPDpqqbPGZ3Qvu\nHQIDAQAB\n-----END PUBLIC KEY-----\n"
+    <<~TEXT
+      -----BEGIN PUBLIC KEY-----
+      MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu3L4vnpNLzVH31MeWI39
+      4F0wKeJFsLDAsNXGeOu0QF2x+h1zLWZw/agqD2R3JPU9/kaDJGPIV2Sn5zLyUA9S
+      6swCCMOtn7BBR9g9sucgXJmUFB0tACH2QSgHywMAybGfmSb3LsEMNKsGJ9VsvYoh
+      8lDET6X4Pyw+ZJU0/OLo/41q9w+OrGtlsTm/PuPIeXnxa6BLqnDaxC+4IcjG/FiP
+      ahNCTINl/1F/TgSSDZ4Taf4U9XFEIFw8wmgploELozzIzKq+t8nhQYkgAkt64euW
+      pva3qL5KD1mTIZQEP+LZvh3s2WHrLi3fhbdRuwQ2c0KkJA2oSTFPDpqqbPGZ3Qvu
+      HQIDAQAB
+      -----END PUBLIC KEY-----
+    TEXT
  end

  let(:public_key_id) { 'https://example.com/alice#main-key' }
--- a/spec/services/activitypub/process_collection_service_spec.rb
+++ b/spec/services/activitypub/process_collection_service_spec.rb
@ -100,8 +100,18 @@ RSpec.describe ActivityPub::ProcessCollectionService, type: :service do
                    username: 'bob',
                    domain: 'example.com',
                    uri: 'https://example.com/users/bob',
-                    public_key: "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuuYyoyfsRkYnXRotMsId\nW3euBDDfiv9oVqOxUVC7bhel8KednIMrMCRWFAkgJhbrlzbIkjVr68o1MP9qLcn7\nCmH/BXHp7yhuFTr4byjdJKpwB+/i2jNEsvDH5jR8WTAeTCe0x/QHg21V3F7dSI5m\nCCZ/1dSIyOXLRTWVlfDlm3rE4ntlCo+US3/7oSWbg/4/4qEnt1HC32kvklgScxua\n4LR5ATdoXa5bFoopPWhul7MJ6NyWCyQyScUuGdlj8EN4kmKQJvphKHrI9fvhgOuG\nTvhTR1S5InA4azSSchY0tXEEw/VNxraeX0KPjbgr6DPcwhPd/m0nhVDq0zVyVBBD\nMwIDAQAB\n-----END PUBLIC KEY-----\n",
-                    private_key: nil)
+                    private_key: nil,
+                    public_key: <<~TEXT)
+                      -----BEGIN PUBLIC KEY-----
+                      MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuuYyoyfsRkYnXRotMsId
+                      W3euBDDfiv9oVqOxUVC7bhel8KednIMrMCRWFAkgJhbrlzbIkjVr68o1MP9qLcn7
+                      CmH/BXHp7yhuFTr4byjdJKpwB+/i2jNEsvDH5jR8WTAeTCe0x/QHg21V3F7dSI5m
+                      CCZ/1dSIyOXLRTWVlfDlm3rE4ntlCo+US3/7oSWbg/4/4qEnt1HC32kvklgScxua
+                      4LR5ATdoXa5bFoopPWhul7MJ6NyWCyQyScUuGdlj8EN4kmKQJvphKHrI9fvhgOuG
+                      TvhTR1S5InA4azSSchY0tXEEw/VNxraeX0KPjbgr6DPcwhPd/m0nhVDq0zVyVBBD
+                      MwIDAQAB
+                      -----END PUBLIC KEY-----
+                    TEXT
        end

        let(:payload) do
@ -125,7 +135,14 @@ RSpec.describe ActivityPub::ProcessCollectionService, type: :service do
              type: 'RsaSignature2017',
              creator: 'https://example.com/users/bob#main-key',
              created: '2022-03-09T21:57:25Z',
-              signatureValue: 'WculK0LelTQ0MvGwU9TPoq5pFzFfGYRDCJqjZ232/Udj4CHqDTGOSw5UTDLShqBOyycCkbZGrQwXG+dpyDpQLSe1UVPZ5TPQtc/9XtI57WlS2nMNpdvRuxGnnb2btPdesXZ7n3pCxo0zjaXrJMe0mqQh5QJO22mahb4bDwwmfTHgbD3nmkD+fBfGi+UV2qWwqr+jlV4L4JqNkh0gWljF5KTePLRRZCuWiQ/FAt7c67636cdIPf7fR+usjuZltTQyLZKEGuK8VUn2Gkfsx5qns7Vcjvlz1JqlAjyO8HPBbzTTHzUG2nUOIgC3PojCSWv6mNTmRGoLZzOscCAYQA6cKw==',
+              signatureValue: 'WculK0LelTQ0MvGwU9TPoq5pFzFfGYRDCJqjZ232/Udj4' \
+                              'CHqDTGOSw5UTDLShqBOyycCkbZGrQwXG+dpyDpQLSe1UV' \
+                              'PZ5TPQtc/9XtI57WlS2nMNpdvRuxGnnb2btPdesXZ7n3p' \
+                              'Cxo0zjaXrJMe0mqQh5QJO22mahb4bDwwmfTHgbD3nmkD+' \
+                              'fBfGi+UV2qWwqr+jlV4L4JqNkh0gWljF5KTePLRRZCuWi' \
+                              'Q/FAt7c67636cdIPf7fR+usjuZltTQyLZKEGuK8VUn2Gk' \
+                              'fsx5qns7Vcjvlz1JqlAjyO8HPBbzTTHzUG2nUOIgC3Poj' \
+                              'CSWv6mNTmRGoLZzOscCAYQA6cKw==',
            },
            '@id': 'https://example.com/users/bob/statuses/107928807471117876/activity',
            '@type': 'https://www.w3.org/ns/activitystreams#Create',
--- a/spec/services/fetch_link_card_service_spec.rb
+++ b/spec/services/fetch_link_card_service_spec.rb
@ -100,7 +100,14 @@ RSpec.describe FetchLinkCardService, type: :service do
  end

  context 'with a remote status' do
-    let(:status) { Fabricate(:status, account: Fabricate(:account, domain: 'example.com'), text: 'Habt ihr ein paar gute Links zu <a>foo</a> #<span class="tag"><a href="https://quitter.se/tag/wannacry" target="_blank" rel="tag noopener noreferrer" title="https://quitter.se/tag/wannacry">Wannacry</a></span> herumfliegen?   Ich will mal unter <br> <a href="https://github.com/qbi/WannaCry" target="_blank" rel="noopener noreferrer" title="https://github.com/qbi/WannaCry">https://github.com/qbi/WannaCry</a> was sammeln. !<a href="http://sn.jonkman.ca/group/416/id" target="_blank" rel="noopener noreferrer" title="http://sn.jonkman.ca/group/416/id">security</a>&nbsp;') }
+    let(:status) do
+      Fabricate(:status, account: Fabricate(:account, domain: 'example.com'), text: <<-TEXT)
+      Habt ihr ein paar gute Links zu <a>foo</a>
+      #<span class="tag"><a href="https://quitter.se/tag/wannacry" target="_blank" rel="tag noopener noreferrer" title="https://quitter.se/tag/wannacry">Wannacry</a></span> herumfliegen?
+      Ich will mal unter <br> <a href="https://github.com/qbi/WannaCry" target="_blank" rel="noopener noreferrer" title="https://github.com/qbi/WannaCry">https://github.com/qbi/WannaCry</a> was sammeln. !
+      <a href="http://sn.jonkman.ca/group/416/id" target="_blank" rel="noopener noreferrer" title="http://sn.jonkman.ca/group/416/id">security</a>&nbsp;
+      TEXT
+    end

    it 'parses out URLs' do
      expect(a_request(:get, 'https://github.com/qbi/WannaCry')).to have_been_made.at_least_once