Additional specs for URI handling (#2759)

8 years ago · 8d4e7504b1
parent aa6a26a2d5
commit 8d4e7504b1
5 changed files with 133 additions and 0 deletions
--- a/spec/fixtures/requests/localdomain-feed.txt
+++ b/spec/fixtures/requests/localdomain-feed.txt
@ -0,0 +1,57 @@
 HTTP/1.1 200 OK
 Date: Thu, 20 Apr 2017 07:36:08 GMT
 Content-Type: application/atom+xml; charset=utf-8
 Transfer-Encoding: chunked
 Connection: keep-alive
 Server: Mastodon
 X-Frame-Options: DENY
 X-Content-Type-Options: nosniff
 X-XSS-Protection: 1; mode=block
 Link: <https://social.sitedethib.com/.well-known/webfinger?resource=acct%3AThib%40sitedethib.com>; rel="lrdd"; type="application/xrd+xml", <https://social.sitedethib.com/users/Thib.atom>; rel="alternate"; type="application/atom+xml"
 Vary: Accept-Encoding
 ETag: W/"1fa54baac599205a1e54c136dea2b671"
 Cache-Control: max-age=0, private, must-revalidate
 Set-Cookie: _mastodon_session=Vk5XbERyQ0NscjJhdEw1eVEyY3JwQTlBVThObUJ1N3NFcVlJaCtpNU5FSmZlTzFIZ2FqSzhVY1lneFlLQ1haNkh1SDM5L0FSdnFLTGwwTnhJMy9qWWI5aWRnM1NOU1NLTmtuamR5cG5Ebm8vekFNL20ydGkxYXFXU2FwVTF1NnctLXdxdFhNVFA2VmlFVm5BY25QU2N1clE9PQ%3D%3D--47e86fed56f94d3998bfc3837af8de93ec8c104e; path=/; secure; HttpOnly
 X-Request-Id: 071ec889-04fb-4efa-b55e-81eb90772b50
 X-Runtime: 1.173933
 Strict-Transport-Security: max-age=31536000; includeSubDomains
 <?xml version="1.0"?>
 <feed xmlns="http://www.w3.org/2005/Atom" xmlns:thr="http://purl.org/syndication/thread/1.0" xmlns:activity="http://activitystrea.ms/spec/1.0/" xmlns:poco="http://portablecontacts.net/spec/1.0" xmlns:media="http://purl.org/syndication/atommedia" xmlns:ostatus="http://ostatus.org/schema/1.0" xmlns:mastodon="http://mastodon.social/schema/1.0">
  <id>https://webdomain.com/users/foo.atom</id>
  <title>foo</title>
  <subtitle>foo</subtitle>
  <updated>2017-04-08T15:38:58Z</updated>
  <logo>https://quitter.no/avatar/7477-300-20160211190340.png</logo>
  <author>
    <id>https://webdomain.com/users/foo</id>
    <activity:object-type>http://activitystrea.ms/schema/1.0/person</activity:object-type>
    <uri>https://webdomain.com/users/foo</uri>
    <name>foo</name>
    <email>foo@localdomain.com</email>
    <summary>foo</summary>
    <link rel="alternate" type="text/html" href="https://webdomain.com/@foo"/>
    <link rel="avatar" type="image/jpeg" media:width="120" media:height="120" href="https://quitter.no/avatar/7477-300-20160211190340.png"/>
    <poco:preferredUsername>foo</poco:preferredUsername>
    <poco:displayName>foo</poco:displayName>
    <poco:note>foo</poco:note>
    <mastodon:scope>public</mastodon:scope>
  </author>
  <link rel="alternate" type="text/html" href="https://webdomain.com/@foo"/>
  <link rel="self" type="application/atom+xml" href="https://webdomain.com/users/foo.atom"/>
  <link rel="hub" href="https://webdomain.com/api/push"/>
  <link rel="salmon" href="https://webdomain.com/api/salmon/1"/>
  <entry>
    <id>tag:localdomain.com,2017-04-19:objectId=12774:objectType=Status</id>
    <published>2017-04-19T22:28:01Z</published>
    <updated>2017-04-19T22:28:01Z</updated>
    <title>New status by foo</title>
    <activity:object-type>http://activitystrea.ms/schema/1.0/comment</activity:object-type>
    <activity:verb>http://activitystrea.ms/schema/1.0/post</activity:verb>
    <content type="html" xml:lang="fr">&lt;p&gt;Meh, ça foire l&amp;apos;attribution des boosts.&lt;br /&gt;Faudra que je corrige ça…&lt;/p&gt;</content>
    <mastodon:scope>unlisted</mastodon:scope>
    <link rel="alternate" type="text/html" href="https://webdomain.com/users/foo/updates/93"/>
    <link rel="self" type="application/atom+xml" href="https://webdomain.com/users/foo/updates/93.atom"/>
    <thr:in-reply-to ref="tag:localdomain.com,2017-04-19:objectId=12658:objectType=Status" href="https://webdomain.com/@foo/12658"/>
  </entry>
 </feed>
--- a/spec/fixtures/requests/localdomain-hostmeta.txt
+++ b/spec/fixtures/requests/localdomain-hostmeta.txt
@ -0,0 +1,14 @@
 HTTP/1.1 200 OK
 Server: nginx/1.6.2
 Date: Sun, 20 Mar 2016 11:11:00 GMT
 Content-Type: application/xrd+xml
 Transfer-Encoding: chunked
 Connection: keep-alive
 Access-Control-Allow-Origin: *
 Vary: Accept-Encoding,Cookie
 Strict-Transport-Security: max-age=31536000; includeSubdomains;
 <?xml version="1.0"?>
 <XRD xmlns="http://docs.oasis-open.org/ns/xri/xrd-1.0">
  <Link rel="lrdd" type="application/xrd+xml" template="https://webdomain.com/.well-known/webfinger?resource={uri}"/>
 </XRD>
--- a/spec/fixtures/requests/localdomain-webfinger.txt
+++ b/spec/fixtures/requests/localdomain-webfinger.txt
@ -0,0 +1,20 @@
 HTTP/1.1 200 OK
 Server: nginx/1.6.2
 Date: Sun, 20 Mar 2016 11:11:00 GMT
 Content-Type: application/xrd+xml
 Transfer-Encoding: chunked
 Connection: keep-alive
 Access-Control-Allow-Origin: *
 Vary: Accept-Encoding,Cookie
 Strict-Transport-Security: max-age=31536000; includeSubdomains;
 <?xml version="1.0"?>
 <XRD xmlns="http://docs.oasis-open.org/ns/xri/xrd-1.0">
  <Subject>acct:foo@localdomain.com</Subject>
  <Alias>https://webdomain.com/@foo</Alias>
  <Link rel="http://webfinger.net/rel/profile-page" type="text/html" href="https://webdomain.com/@foo"/>
  <Link rel="http://schemas.google.com/g/2010#updates-from" type="application/atom+xml" href="https://webdomain.com/users/foo.atom"/>
  <Link rel="salmon" href="https://webdomain.com/api/salmon/1"/>
  <Link rel="magic-public-key" href="data:application/magic-public-key,RSA.wnIYUQp-jMqH8tzStBoVriiGtbMvH12IU125p-3shZHxJNDi7RHwseKi5ADEGwGwpXLMxqiyNlgCff1hG9DBc8MzHZi1V93F2hCOXK0bqZm2lbsWfjkpsDIdBZ8TltwSejuQCt_rqL-K5XCfknd94P7tHOCBnizQRBanj0IdcSSqh7CmRS5wa1UjwflXVMsgbDc2io1knMeMkXsl0jzwt-CFHprmITzWy9X6Ia4QevkntiXdMlwUf_UoJC7BRns-J-j_dz2LqFl1QfspMhR2R9p8plDSD-jjk8DUVSBFZ7GLWVHEd6dWkLncEVEeRLliCaQQBqF1huSuMDtYWfukWQ==.AQAB"/>
  <Link rel="http://ostatus.org/schema/1.0/subscribe" template="https://webdomain.com/authorize_follow?acct={uri}"/>
 </XRD>
--- a/spec/services/follow_remote_account_service_spec.rb
+++ b/spec/services/follow_remote_account_service_spec.rb
@ -15,6 +15,10 @@ RSpec.describe FollowRemoteAccountService do
    stub_request(:get, "https://quitter.no/.well-known/webfinger?resource=acct:catsrgr8@quitter.no").to_return(status: 404)
    stub_request(:get, "https://quitter.no/api/statuses/user_timeline/7477.atom").to_return(request_fixture('feed.txt'))
    stub_request(:get, "https://quitter.no/avatar/7477-300-20160211190340.png").to_return(request_fixture('avatar.txt'))
    stub_request(:get, "https://localdomain.com/.well-known/host-meta").to_return(request_fixture('localdomain-hostmeta.txt'))
    stub_request(:get, "https://localdomain.com/.well-known/webfinger?resource=acct:foo@localdomain.com").to_return(status: 404)
    stub_request(:get, "https://webdomain.com/.well-known/webfinger?resource=acct:foo@localdomain.com").to_return(request_fixture('localdomain-webfinger.txt'))
    stub_request(:get, "https://webdomain.com/users/foo.atom").to_return(request_fixture('localdomain-feed.txt'))
  end
  it 'raises error if no such user can be resolved via webfinger' do
@ -56,4 +60,12 @@ RSpec.describe FollowRemoteAccountService do
  it 'prevents hijacking inexisting accounts' do
    expect { subject.call('hacker2@redirected.com') }.to raise_error Goldfinger::Error
  end
  it 'returns a new remote account' do
    account = subject.call('foo@localdomain.com')
    expect(account.username).to eq 'foo'
    expect(account.domain).to eq 'localdomain.com'
    expect(account.remote_url).to eq 'https://webdomain.com/users/foo.atom'
  end
 end
--- a/spec/services/process_interaction_service_spec.rb
+++ b/spec/services/process_interaction_service_spec.rb
@ -3,6 +3,7 @@ require 'rails_helper'
 RSpec.describe ProcessInteractionService do
  let(:receiver) { Fabricate(:user, email: 'alice@example.com', account: Fabricate(:account, username: 'alice')).account }
  let(:sender)   { Fabricate(:user, email: 'bob@example.com', account: Fabricate(:account, username: 'bob')).account }
  let(:remote_sender) { Fabricate(:account, username: 'carol', domain: 'localdomain.com', uri: 'https://webdomain.com/users/carol') }
  subject { ProcessInteractionService.new }
@ -31,6 +32,35 @@ XML
    end
  end
  describe 'follow request slap from known remote user identified by email' do
    before do
      receiver.update(locked: true)
      # Copy already-generated key
      remote_sender.update(private_key: sender.private_key, public_key: remote_sender.public_key)
      payload = <<XML
 <entry xmlns="http://www.w3.org/2005/Atom" xmlns:activity="http://activitystrea.ms/spec/1.0/">
  <author>
    <email>carol@localdomain.com</email>
    <name>carol</name>
    <uri>https://webdomain.com/users/carol</uri>
  </author>
  <id>someIdHere</id>
  <activity:verb>http://activitystrea.ms/schema/1.0/request-friend</activity:verb>
 </entry>
 XML
      envelope = OStatus2::Salmon.new.pack(payload, remote_sender.keypair)
      subject.call(envelope, receiver)
    end
    it 'creates a record' do
      expect(FollowRequest.find_by(account: remote_sender, target_account: receiver)).to_not be_nil
    end
  end
  describe 'follow request authorization slap' do
    before do
      receiver.update(locked: true)