Additional specs for URI handling (#2759)

2024-11-22 06:06:45 +00:00 · 2017-05-03 20:40:14 +02:00 · 2017-05-03 20:40:14 +02:00 · 8d4e7504b1
parent aa6a26a2d5
commit 8d4e7504b1
5 changed files with 133 additions and 0 deletions
--- a/spec/fixtures/requests/localdomain-feed.txt
+++ b/spec/fixtures/requests/localdomain-feed.txt
@ -0,0 +1,57 @@
+HTTP/1.1 200 OK
+Date: Thu, 20 Apr 2017 07:36:08 GMT
+Content-Type: application/atom+xml; charset=utf-8
+Transfer-Encoding: chunked
+Connection: keep-alive
+Server: Mastodon
+X-Frame-Options: DENY
+X-Content-Type-Options: nosniff
+X-XSS-Protection: 1; mode=block
+Link: <https://social.sitedethib.com/.well-known/webfinger?resource=acct%3AThib%40sitedethib.com>; rel="lrdd"; type="application/xrd+xml", <https://social.sitedethib.com/users/Thib.atom>; rel="alternate"; type="application/atom+xml"
+Vary: Accept-Encoding
+ETag: W/"1fa54baac599205a1e54c136dea2b671"
+Cache-Control: max-age=0, private, must-revalidate
+Set-Cookie: _mastodon_session=Vk5XbERyQ0NscjJhdEw1eVEyY3JwQTlBVThObUJ1N3NFcVlJaCtpNU5FSmZlTzFIZ2FqSzhVY1lneFlLQ1haNkh1SDM5L0FSdnFLTGwwTnhJMy9qWWI5aWRnM1NOU1NLTmtuamR5cG5Ebm8vekFNL20ydGkxYXFXU2FwVTF1NnctLXdxdFhNVFA2VmlFVm5BY25QU2N1clE9PQ%3D%3D--47e86fed56f94d3998bfc3837af8de93ec8c104e; path=/; secure; HttpOnly
+X-Request-Id: 071ec889-04fb-4efa-b55e-81eb90772b50
+X-Runtime: 1.173933
+Strict-Transport-Security: max-age=31536000; includeSubDomains
+
+<?xml version="1.0"?>
+<feed xmlns="http://www.w3.org/2005/Atom" xmlns:thr="http://purl.org/syndication/thread/1.0" xmlns:activity="http://activitystrea.ms/spec/1.0/" xmlns:poco="http://portablecontacts.net/spec/1.0" xmlns:media="http://purl.org/syndication/atommedia" xmlns:ostatus="http://ostatus.org/schema/1.0" xmlns:mastodon="http://mastodon.social/schema/1.0">
+  <id>https://webdomain.com/users/foo.atom</id>
+  <title>foo</title>
+  <subtitle>foo</subtitle>
+  <updated>2017-04-08T15:38:58Z</updated>
+  <logo>https://quitter.no/avatar/7477-300-20160211190340.png</logo>
+  <author>
+    <id>https://webdomain.com/users/foo</id>
+    <activity:object-type>http://activitystrea.ms/schema/1.0/person</activity:object-type>
+    <uri>https://webdomain.com/users/foo</uri>
+    <name>foo</name>
+    <email>foo@localdomain.com</email>
+    <summary>foo</summary>
+    <link rel="alternate" type="text/html" href="https://webdomain.com/@foo"/>
+    <link rel="avatar" type="image/jpeg" media:width="120" media:height="120" href="https://quitter.no/avatar/7477-300-20160211190340.png"/>
+    <poco:preferredUsername>foo</poco:preferredUsername>
+    <poco:displayName>foo</poco:displayName>
+    <poco:note>foo</poco:note>
+    <mastodon:scope>public</mastodon:scope>
+  </author>
+  <link rel="alternate" type="text/html" href="https://webdomain.com/@foo"/>
+  <link rel="self" type="application/atom+xml" href="https://webdomain.com/users/foo.atom"/>
+  <link rel="hub" href="https://webdomain.com/api/push"/>
+  <link rel="salmon" href="https://webdomain.com/api/salmon/1"/>
+  <entry>
+    <id>tag:localdomain.com,2017-04-19:objectId=12774:objectType=Status</id>
+    <published>2017-04-19T22:28:01Z</published>
+    <updated>2017-04-19T22:28:01Z</updated>
+    <title>New status by foo</title>
+    <activity:object-type>http://activitystrea.ms/schema/1.0/comment</activity:object-type>
+    <activity:verb>http://activitystrea.ms/schema/1.0/post</activity:verb>
+    <content type="html" xml:lang="fr">&lt;p&gt;Meh, ça foire l&amp;apos;attribution des boosts.&lt;br /&gt;Faudra que je corrige ça…&lt;/p&gt;</content>
+    <mastodon:scope>unlisted</mastodon:scope>
+    <link rel="alternate" type="text/html" href="https://webdomain.com/users/foo/updates/93"/>
+    <link rel="self" type="application/atom+xml" href="https://webdomain.com/users/foo/updates/93.atom"/>
+    <thr:in-reply-to ref="tag:localdomain.com,2017-04-19:objectId=12658:objectType=Status" href="https://webdomain.com/@foo/12658"/>
+  </entry>
+</feed>
--- a/spec/fixtures/requests/localdomain-hostmeta.txt
+++ b/spec/fixtures/requests/localdomain-hostmeta.txt
@ -0,0 +1,14 @@
+HTTP/1.1 200 OK
+Server: nginx/1.6.2
+Date: Sun, 20 Mar 2016 11:11:00 GMT
+Content-Type: application/xrd+xml
+Transfer-Encoding: chunked
+Connection: keep-alive
+Access-Control-Allow-Origin: *
+Vary: Accept-Encoding,Cookie
+Strict-Transport-Security: max-age=31536000; includeSubdomains;
+
+<?xml version="1.0"?>
+<XRD xmlns="http://docs.oasis-open.org/ns/xri/xrd-1.0">
+  <Link rel="lrdd" type="application/xrd+xml" template="https://webdomain.com/.well-known/webfinger?resource={uri}"/>
+</XRD>
--- a/spec/fixtures/requests/localdomain-webfinger.txt
+++ b/spec/fixtures/requests/localdomain-webfinger.txt
@ -0,0 +1,20 @@
+HTTP/1.1 200 OK
+Server: nginx/1.6.2
+Date: Sun, 20 Mar 2016 11:11:00 GMT
+Content-Type: application/xrd+xml
+Transfer-Encoding: chunked
+Connection: keep-alive
+Access-Control-Allow-Origin: *
+Vary: Accept-Encoding,Cookie
+Strict-Transport-Security: max-age=31536000; includeSubdomains;
+
+<?xml version="1.0"?>
+<XRD xmlns="http://docs.oasis-open.org/ns/xri/xrd-1.0">
+  <Subject>acct:foo@localdomain.com</Subject>
+  <Alias>https://webdomain.com/@foo</Alias>
+  <Link rel="http://webfinger.net/rel/profile-page" type="text/html" href="https://webdomain.com/@foo"/>
+  <Link rel="http://schemas.google.com/g/2010#updates-from" type="application/atom+xml" href="https://webdomain.com/users/foo.atom"/>
+  <Link rel="salmon" href="https://webdomain.com/api/salmon/1"/>
+  <Link rel="magic-public-key" href="data:application/magic-public-key,RSA.wnIYUQp-jMqH8tzStBoVriiGtbMvH12IU125p-3shZHxJNDi7RHwseKi5ADEGwGwpXLMxqiyNlgCff1hG9DBc8MzHZi1V93F2hCOXK0bqZm2lbsWfjkpsDIdBZ8TltwSejuQCt_rqL-K5XCfknd94P7tHOCBnizQRBanj0IdcSSqh7CmRS5wa1UjwflXVMsgbDc2io1knMeMkXsl0jzwt-CFHprmITzWy9X6Ia4QevkntiXdMlwUf_UoJC7BRns-J-j_dz2LqFl1QfspMhR2R9p8plDSD-jjk8DUVSBFZ7GLWVHEd6dWkLncEVEeRLliCaQQBqF1huSuMDtYWfukWQ==.AQAB"/>
+  <Link rel="http://ostatus.org/schema/1.0/subscribe" template="https://webdomain.com/authorize_follow?acct={uri}"/>
+</XRD>
--- a/spec/services/follow_remote_account_service_spec.rb
+++ b/spec/services/follow_remote_account_service_spec.rb
@ -15,6 +15,10 @@ RSpec.describe FollowRemoteAccountService do
    stub_request(:get, "https://quitter.no/.well-known/webfinger?resource=acct:catsrgr8@quitter.no").to_return(status: 404)
    stub_request(:get, "https://quitter.no/api/statuses/user_timeline/7477.atom").to_return(request_fixture('feed.txt'))
    stub_request(:get, "https://quitter.no/avatar/7477-300-20160211190340.png").to_return(request_fixture('avatar.txt'))
+    stub_request(:get, "https://localdomain.com/.well-known/host-meta").to_return(request_fixture('localdomain-hostmeta.txt'))
+    stub_request(:get, "https://localdomain.com/.well-known/webfinger?resource=acct:foo@localdomain.com").to_return(status: 404)
+    stub_request(:get, "https://webdomain.com/.well-known/webfinger?resource=acct:foo@localdomain.com").to_return(request_fixture('localdomain-webfinger.txt'))
+    stub_request(:get, "https://webdomain.com/users/foo.atom").to_return(request_fixture('localdomain-feed.txt'))
  end

  it 'raises error if no such user can be resolved via webfinger' do
@ -56,4 +60,12 @@ RSpec.describe FollowRemoteAccountService do
  it 'prevents hijacking inexisting accounts' do
    expect { subject.call('hacker2@redirected.com') }.to raise_error Goldfinger::Error
  end
+
+  it 'returns a new remote account' do
+    account = subject.call('foo@localdomain.com')
+
+    expect(account.username).to eq 'foo'
+    expect(account.domain).to eq 'localdomain.com'
+    expect(account.remote_url).to eq 'https://webdomain.com/users/foo.atom'
+  end
 end
--- a/spec/services/process_interaction_service_spec.rb
+++ b/spec/services/process_interaction_service_spec.rb
@ -3,6 +3,7 @@ require 'rails_helper'
 RSpec.describe ProcessInteractionService do
  let(:receiver) { Fabricate(:user, email: 'alice@example.com', account: Fabricate(:account, username: 'alice')).account }
  let(:sender)   { Fabricate(:user, email: 'bob@example.com', account: Fabricate(:account, username: 'bob')).account }
+  let(:remote_sender) { Fabricate(:account, username: 'carol', domain: 'localdomain.com', uri: 'https://webdomain.com/users/carol') }

  subject { ProcessInteractionService.new }

@ -31,6 +32,35 @@ XML
    end
  end

+  describe 'follow request slap from known remote user identified by email' do
+    before do
+      receiver.update(locked: true)
+      # Copy already-generated key
+      remote_sender.update(private_key: sender.private_key, public_key: remote_sender.public_key)
+
+      payload = <<XML
+<entry xmlns="http://www.w3.org/2005/Atom" xmlns:activity="http://activitystrea.ms/spec/1.0/">
+  <author>
+    <email>carol@localdomain.com</email>
+    <name>carol</name>
+    <uri>https://webdomain.com/users/carol</uri>
+  </author>
+
+  <id>someIdHere</id>
+  <activity:verb>http://activitystrea.ms/schema/1.0/request-friend</activity:verb>
+</entry>
+XML
+
+      envelope = OStatus2::Salmon.new.pack(payload, remote_sender.keypair)
+      subject.call(envelope, receiver)
+    end
+
+    it 'creates a record' do
+      expect(FollowRequest.find_by(account: remote_sender, target_account: receiver)).to_not be_nil
+    end
+  end
+
+
  describe 'follow request authorization slap' do
    before do
      receiver.update(locked: true)