Merge branch 'private-pins' into 'develop'

Support private pinned posts from Mastodon

See merge request pleroma/pleroma!3611

lib/pleroma/web/activity_pub/activity_pub.ex

@@ -1664,7 +1664,10 @@ def pin_data_from_featured_collection(%{
         "orderedItems" => objects
       })
       when type in ["OrderedCollection", "Collection"] do
-    Map.new(objects, fn %{"id" => object_ap_id} -> {object_ap_id, NaiveDateTime.utc_now()} end)
+    Map.new(objects, fn
+      %{"id" => object_ap_id} -> {object_ap_id, NaiveDateTime.utc_now()}
+      object_ap_id when is_binary(object_ap_id) -> {object_ap_id, NaiveDateTime.utc_now()}
+    end)
   end
 
   def fetch_and_prepare_featured_from_ap_id(nil) do

test/fixtures/mastodon/collections/external_featured.json

@@ -0,0 +1,14 @@
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams",
+    "https://{{domain}}/schemas/litepub-0.1.jsonld",
+    {
+      "@language": "und"
+    }
+  ],
+  "id": "https://{{domain}}/users/{{nickname}}/collections/featured",
+  "orderedItems": [
+    "https://{{domain}}/objects/{{object_id}}"
+  ],
+  "type": "OrderedCollection"
+}

test/pleroma/web/activity_pub/activity_pub_test.exs

@@ -312,6 +312,83 @@ test "fetches user featured collection" do
 
       assert %{data: %{"id" => ^object_url}} = Object.get_by_ap_id(object_url)
     end
+
+    test "fetches user featured collection without embedded object" do
+      ap_id = "https://example.com/users/lain"
+
+      featured_url = "https://example.com/users/lain/collections/featured"
+
+      user_data =
+        "test/fixtures/users_mock/user.json"
+        |> File.read!()
+        |> String.replace("{{nickname}}", "lain")
+        |> Jason.decode!()
+        |> Map.put("featured", featured_url)
+        |> Jason.encode!()
+
+      object_id = Ecto.UUID.generate()
+
+      featured_data =
+        "test/fixtures/mastodon/collections/external_featured.json"
+        |> File.read!()
+        |> String.replace("{{domain}}", "example.com")
+        |> String.replace("{{nickname}}", "lain")
+        |> String.replace("{{object_id}}", object_id)
+
+      object_url = "https://example.com/objects/#{object_id}"
+
+      object_data =
+        "test/fixtures/statuses/note.json"
+        |> File.read!()
+        |> String.replace("{{object_id}}", object_id)
+        |> String.replace("{{nickname}}", "lain")
+
+      Tesla.Mock.mock(fn
+        %{
+          method: :get,
+          url: ^ap_id
+        } ->
+          %Tesla.Env{
+            status: 200,
+            body: user_data,
+            headers: [{"content-type", "application/activity+json"}]
+          }
+
+        %{
+          method: :get,
+          url: ^featured_url
+        } ->
+          %Tesla.Env{
+            status: 200,
+            body: featured_data,
+            headers: [{"content-type", "application/activity+json"}]
+          }
+      end)
+
+      Tesla.Mock.mock_global(fn
+        %{
+          method: :get,
+          url: ^object_url
+        } ->
+          %Tesla.Env{
+            status: 200,
+            body: object_data,
+            headers: [{"content-type", "application/activity+json"}]
+          }
+      end)
+
+      {:ok, user} = ActivityPub.make_user_from_ap_id(ap_id)
+      Process.sleep(50)
+
+      assert user.featured_address == featured_url
+      assert Map.has_key?(user.pinned_objects, object_url)
+
+      in_db = Pleroma.User.get_by_ap_id(ap_id)
+      assert in_db.featured_address == featured_url
+      assert Map.has_key?(user.pinned_objects, object_url)
+
+      assert %{data: %{"id" => ^object_url}} = Object.get_by_ap_id(object_url)
+    end
   end
 
   test "it fetches the appropriate tag-restricted posts" do

test/pleroma/web/mastodon_api/controllers/account_controller_test.exs

@@ -5,7 +5,9 @@
 defmodule Pleroma.Web.MastodonAPI.AccountControllerTest do
   use Pleroma.Web.ConnCase
 
+  alias Pleroma.Object
   alias Pleroma.Repo
+  alias Pleroma.Tests.ObanHelpers
   alias Pleroma.User
   alias Pleroma.Web.ActivityPub.ActivityPub
   alias Pleroma.Web.ActivityPub.InternalFetchActor
@@ -404,15 +406,6 @@ test "gets users statuses", %{conn: conn} do
       assert id_two == to_string(activity.id)
     end
 
-    test "unimplemented pinned statuses feature", %{conn: conn} do
-      note = insert(:note_activity)
-      user = User.get_cached_by_ap_id(note.data["actor"])
-
-      conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?pinned=true")
-
-      assert json_response_and_validate_schema(conn, 200) == []
-    end
-
     test "gets an users media, excludes reblogs", %{conn: conn} do
       note = insert(:note_activity)
       user = User.get_cached_by_ap_id(note.data["actor"])
@@ -1038,6 +1031,35 @@ test "returns pinned statuses", %{conn: conn, user: user, activity: %{id: activi
     end
   end
 
+  test "view pinned private statuses" do
+    user = insert(:user)
+    reader = insert(:user)
+
+    # Create a private status and pin it
+    {:ok, %{id: activity_id} = activity} =
+      CommonAPI.post(user, %{status: "psst", visibility: "private"})
+
+    %{data: %{"id" => object_ap_id}} = Object.normalize(activity)
+    {:ok, _} = User.add_pinned_object_id(user, object_ap_id)
+
+    %{conn: conn} = oauth_access(["read:statuses"], user: reader)
+
+    # A non-follower can't see the pinned status
+    assert [] ==
+             conn
+             |> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
+             |> json_response_and_validate_schema(200)
+
+    # Follow the user, then the pinned status can be seen
+    CommonAPI.follow(reader, user)
+    ObanHelpers.perform_all()
+
+    assert [%{"id" => ^activity_id, "pinned" => true}] =
+             conn
+             |> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
+             |> json_response_and_validate_schema(200)
+  end
+
   test "blocking / unblocking a user" do
     %{conn: conn} = oauth_access(["follow"])
     other_user = insert(:user)