spc-pleroma/test/pleroma/web/mastodon_api/controllers/account_controller_test.exs

# Pleroma: A lightweight social networking server
# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
# SPDX-License-Identifier: AGPL-3.0-only

defmodule Pleroma.Web.MastodonAPI.AccountControllerTest do
  use Pleroma.Web.ConnCase

  alias Pleroma.Object
  alias Pleroma.Repo
  alias Pleroma.Tests.ObanHelpers
  alias Pleroma.User
  alias Pleroma.UserRelationship
  alias Pleroma.Web.ActivityPub.ActivityPub
  alias Pleroma.Web.ActivityPub.InternalFetchActor
  alias Pleroma.Web.CommonAPI
  alias Pleroma.Web.OAuth.Token
  alias Pleroma.Web.Plugs.SetLocalePlug

  import Pleroma.Factory

  setup do
    Mox.stub_with(Pleroma.UnstubbedConfigMock, Pleroma.Config)
    :ok
  end

  describe "account fetching" do
    test "works by id" do
      %User{id: user_id} = insert(:user)

      assert %{"id" => ^user_id} =
               build_conn()
               |> get("/api/v1/accounts/#{user_id}")
               |> json_response_and_validate_schema(200)

      assert %{"error" => "Can't find user"} =
               build_conn()
               |> get("/api/v1/accounts/-1")
               |> json_response_and_validate_schema(404)
    end

    test "relationship field" do
      %{conn: conn, user: user} = oauth_access(["read"])

      other_user = insert(:user)

      response =
        conn
        |> get("/api/v1/accounts/#{other_user.id}")
        |> json_response_and_validate_schema(200)

      assert response["id"] == other_user.id
      assert response["pleroma"]["relationship"] == %{}

      assert %{"pleroma" => %{"relationship" => %{"following" => false, "followed_by" => false}}} =
               conn
               |> get("/api/v1/accounts/#{other_user.id}?with_relationships=true")
               |> json_response_and_validate_schema(200)

      {:ok, _, %{id: other_id}} = User.follow(user, other_user)

      assert %{
               "id" => ^other_id,
               "pleroma" => %{"relationship" => %{"following" => true, "followed_by" => false}}
             } =
               conn
               |> get("/api/v1/accounts/#{other_id}?with_relationships=true")
               |> json_response_and_validate_schema(200)

      {:ok, _, _} = User.follow(other_user, user)

      assert %{
               "id" => ^other_id,
               "pleroma" => %{"relationship" => %{"following" => true, "followed_by" => true}}
             } =
               conn
               |> get("/api/v1/accounts/#{other_id}?with_relationships=true")
               |> json_response_and_validate_schema(200)
    end

    test "works by nickname" do
      user = insert(:user)

      assert %{"id" => _user_id} =
               build_conn()
               |> get("/api/v1/accounts/#{user.nickname}")
               |> json_response_and_validate_schema(200)
    end

    test "works by nickname for remote users" do
      clear_config([:instance, :limit_to_local_content], false)

      user = insert(:user, nickname: "user@example.com", local: false)

      assert %{"id" => _user_id} =
               build_conn()
               |> get("/api/v1/accounts/#{user.nickname}")
               |> json_response_and_validate_schema(200)
    end

    test "respects limit_to_local_content == :all for remote user nicknames" do
      clear_config([:instance, :limit_to_local_content], :all)

      user = insert(:user, nickname: "user@example.com", local: false)

      assert build_conn()
             |> get("/api/v1/accounts/#{user.nickname}")
             |> json_response_and_validate_schema(404)
    end

    test "respects limit_to_local_content == :unauthenticated for remote user nicknames" do
      clear_config([:instance, :limit_to_local_content], :unauthenticated)

      user = insert(:user, nickname: "user@example.com", local: false)
      reading_user = insert(:user)

      conn =
        build_conn()
        |> get("/api/v1/accounts/#{user.nickname}")

      assert json_response_and_validate_schema(conn, 404)

      conn =
        build_conn()
        |> assign(:user, reading_user)
        |> assign(:token, insert(:oauth_token, user: reading_user, scopes: ["read:accounts"]))
        |> get("/api/v1/accounts/#{user.nickname}")

      assert %{"id" => id} = json_response_and_validate_schema(conn, 200)
      assert id == user.id
    end

    test "accounts fetches correct account for nicknames beginning with numbers", %{conn: conn} do
      # Need to set an old-style integer ID to reproduce the problem
      # (these are no longer assigned to new accounts but were preserved
      # for existing accounts during the migration to flakeIDs)
      user_one = insert(:user, %{id: 1212})
      user_two = insert(:user, %{nickname: "#{user_one.id}garbage"})

      acc_one =
        conn
        |> get("/api/v1/accounts/#{user_one.id}")
        |> json_response_and_validate_schema(:ok)

      acc_two =
        conn
        |> get("/api/v1/accounts/#{user_two.nickname}")
        |> json_response_and_validate_schema(:ok)

      acc_three =
        conn
        |> get("/api/v1/accounts/#{user_two.id}")
        |> json_response_and_validate_schema(:ok)

      refute acc_one == acc_two
      assert acc_two == acc_three
    end

    test "returns 404 when user is invisible", %{conn: conn} do
      user = insert(:user, %{invisible: true})

      assert %{"error" => "Can't find user"} =
               conn
               |> get("/api/v1/accounts/#{user.nickname}")
               |> json_response_and_validate_schema(404)
    end

    test "returns 404 for internal.fetch actor", %{conn: conn} do
      %User{nickname: "internal.fetch"} = InternalFetchActor.get_actor()

      assert %{"error" => "Can't find user"} =
               conn
               |> get("/api/v1/accounts/internal.fetch")
               |> json_response_and_validate_schema(404)
    end

    test "returns 404 for deactivated user", %{conn: conn} do
      user = insert(:user, is_active: false)

      assert %{"error" => "Can't find user"} =
               conn
               |> get("/api/v1/accounts/#{user.id}")
               |> json_response_and_validate_schema(:not_found)
    end
  end

  defp local_and_remote_users do
    local = insert(:user)
    remote = insert(:user, local: false)
    {:ok, local: local, remote: remote}
  end

  describe "user fetching with restrict unauthenticated profiles for local and remote" do
    setup do: local_and_remote_users()

    setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)

    setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)

    test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
      assert %{"error" => "This API requires an authenticated user"} ==
               conn
               |> get("/api/v1/accounts/#{local.id}")
               |> json_response_and_validate_schema(:unauthorized)

      assert %{"error" => "This API requires an authenticated user"} ==
               conn
               |> get("/api/v1/accounts/#{remote.id}")
               |> json_response_and_validate_schema(:unauthorized)
    end

    test "if user is authenticated", %{local: local, remote: remote} do
      %{conn: conn} = oauth_access(["read"])

      res_conn = get(conn, "/api/v1/accounts/#{local.id}")
      assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)

      res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
      assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
    end
  end

  describe "user fetching with restrict unauthenticated profiles for local" do
    setup do: local_and_remote_users()

    setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)

    test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
      res_conn = get(conn, "/api/v1/accounts/#{local.id}")

      assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
               "error" => "This API requires an authenticated user"
             }

      res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
      assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
    end

    test "if user is authenticated", %{local: local, remote: remote} do
      %{conn: conn} = oauth_access(["read"])

      res_conn = get(conn, "/api/v1/accounts/#{local.id}")
      assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)

      res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
      assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
    end
  end

  describe "user fetching with restrict unauthenticated profiles for remote" do
    setup do: local_and_remote_users()

    setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)

    test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
      res_conn = get(conn, "/api/v1/accounts/#{local.id}")
      assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)

      res_conn = get(conn, "/api/v1/accounts/#{remote.id}")

      assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
               "error" => "This API requires an authenticated user"
             }
    end

    test "if user is authenticated", %{local: local, remote: remote} do
      %{conn: conn} = oauth_access(["read"])

      res_conn = get(conn, "/api/v1/accounts/#{local.id}")
      assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)

      res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
      assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
    end
  end

  describe "user timelines" do
    setup do: oauth_access(["read:statuses"])

    test "works with announces that are just addressed to public", %{conn: conn} do
      user = insert(:user, ap_id: "https://honktest/u/test", local: false)
      other_user = insert(:user)

      {:ok, post} = CommonAPI.post(other_user, %{status: "bonkeronk"})

      {:ok, announce, _} =
        %{
          "@context" => "https://www.w3.org/ns/activitystreams",
          "actor" => "https://honktest/u/test",
          "id" => "https://honktest/u/test/bonk/1793M7B9MQ48847vdx",
          "object" => post.data["object"],
          "published" => "2019-06-25T19:33:58Z",
          "to" => ["https://www.w3.org/ns/activitystreams#Public"],
          "type" => "Announce"
        }
        |> ActivityPub.persist(local: false)

      assert resp =
               conn
               |> get("/api/v1/accounts/#{user.id}/statuses")
               |> json_response_and_validate_schema(200)

      assert [%{"id" => id}] = resp
      assert id == announce.id
    end

    test "deactivated user", %{conn: conn} do
      user = insert(:user, is_active: false)

      assert %{"error" => "Can't find user"} ==
               conn
               |> get("/api/v1/accounts/#{user.id}/statuses")
               |> json_response_and_validate_schema(:not_found)
    end

    test "returns 404 when user is invisible", %{conn: conn} do
      user = insert(:user, %{invisible: true})

      assert %{"error" => "Can't find user"} =
               conn
               |> get("/api/v1/accounts/#{user.id}")
               |> json_response_and_validate_schema(404)
    end

    test "respects blocks", %{user: user_one, conn: conn} do
      user_two = insert(:user)
      user_three = insert(:user)

      User.block(user_one, user_two)

      {:ok, activity} = CommonAPI.post(user_two, %{status: "User one sux0rz"})
      {:ok, repeat} = CommonAPI.repeat(activity.id, user_three)

      assert resp =
               conn
               |> get("/api/v1/accounts/#{user_two.id}/statuses")
               |> json_response_and_validate_schema(200)

      assert [%{"id" => id}] = resp
      assert id == activity.id

      # Even a blocked user will deliver the full user timeline, there would be
      #   no point in looking at a blocked users timeline otherwise
      assert resp =
               conn
               |> get("/api/v1/accounts/#{user_two.id}/statuses")
               |> json_response_and_validate_schema(200)

      assert [%{"id" => id}] = resp
      assert id == activity.id

      # Third user's timeline includes the repeat when viewed by unauthenticated user
      resp =
        build_conn()
        |> get("/api/v1/accounts/#{user_three.id}/statuses")
        |> json_response_and_validate_schema(200)

      assert [%{"id" => id}] = resp
      assert id == repeat.id

      # When viewing a third user's timeline, the blocked users' statuses will NOT be shown
      resp = get(conn, "/api/v1/accounts/#{user_three.id}/statuses")

      assert [] == json_response_and_validate_schema(resp, 200)
    end

    test "gets users statuses", %{conn: conn} do
      user_one = insert(:user)
      user_two = insert(:user)
      user_three = insert(:user)

      {:ok, _user_three, _user_one} = User.follow(user_three, user_one)

      {:ok, activity} = CommonAPI.post(user_one, %{status: "HI!!!"})

      {:ok, direct_activity} =
        CommonAPI.post(user_one, %{
          status: "Hi, @#{user_two.nickname}.",
          visibility: "direct"
        })

      {:ok, private_activity} =
        CommonAPI.post(user_one, %{status: "private", visibility: "private"})

      # TODO!!!
      resp =
        conn
        |> get("/api/v1/accounts/#{user_one.id}/statuses")
        |> json_response_and_validate_schema(200)

      assert [%{"id" => id}] = resp
      assert id == to_string(activity.id)

      resp =
        conn
        |> assign(:user, user_two)
        |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
        |> get("/api/v1/accounts/#{user_one.id}/statuses")
        |> json_response_and_validate_schema(200)

      assert [%{"id" => id_one}, %{"id" => id_two}] = resp
      assert id_one == to_string(direct_activity.id)
      assert id_two == to_string(activity.id)

      resp =
        conn
        |> assign(:user, user_three)
        |> assign(:token, insert(:oauth_token, user: user_three, scopes: ["read:statuses"]))
        |> get("/api/v1/accounts/#{user_one.id}/statuses")
        |> json_response_and_validate_schema(200)

      assert [%{"id" => id_one}, %{"id" => id_two}] = resp
      assert id_one == to_string(private_activity.id)
      assert id_two == to_string(activity.id)
    end

    test "gets local-only statuses for authenticated users", %{user: _user, conn: conn} do
      user_one = insert(:user)

      {:ok, activity} = CommonAPI.post(user_one, %{status: "HI!!!", visibility: "local"})

      resp =
        conn
        |> get("/api/v1/accounts/#{user_one.id}/statuses")
        |> json_response_and_validate_schema(200)

      assert [%{"id" => id}] = resp
      assert id == to_string(activity.id)
    end

    test "gets an users media, excludes reblogs", %{conn: conn} do
      note = insert(:note_activity)
      user = User.get_cached_by_ap_id(note.data["actor"])
      other_user = insert(:user)

      file = %Plug.Upload{
        content_type: "image/jpeg",
        path: Path.absname("test/fixtures/image.jpg"),
        filename: "an_image.jpg"
      }

      {:ok, %{id: media_id}} = ActivityPub.upload(file, actor: user.ap_id)

      {:ok, %{id: image_post_id}} = CommonAPI.post(user, %{status: "cofe", media_ids: [media_id]})

      {:ok, %{id: media_id}} = ActivityPub.upload(file, actor: other_user.ap_id)

      {:ok, %{id: other_image_post_id}} =
        CommonAPI.post(other_user, %{status: "cofe2", media_ids: [media_id]})

      {:ok, _announce} = CommonAPI.repeat(other_image_post_id, user)

      conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?only_media=true")

      assert [%{"id" => ^image_post_id}] = json_response_and_validate_schema(conn, 200)

      conn = get(build_conn(), "/api/v1/accounts/#{user.id}/statuses?only_media=1")

      assert [%{"id" => ^image_post_id}] = json_response_and_validate_schema(conn, 200)
    end

    test "gets a user's statuses without reblogs", %{user: user, conn: conn} do
      {:ok, %{id: post_id}} = CommonAPI.post(user, %{status: "HI!!!"})
      {:ok, _} = CommonAPI.repeat(post_id, user)

      conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_reblogs=true")
      assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)

      conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_reblogs=1")
      assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)
    end

    test "filters user's statuses by a hashtag", %{user: user, conn: conn} do
      {:ok, %{id: post_id}} = CommonAPI.post(user, %{status: "#hashtag"})
      {:ok, _post} = CommonAPI.post(user, %{status: "hashtag"})

      conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?tagged=hashtag")
      assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)
    end

    test "the user views their own timelines and excludes direct messages", %{
      user: user,
      conn: conn
    } do
      {:ok, %{id: public_activity_id}} =
        CommonAPI.post(user, %{status: ".", visibility: "public"})

      {:ok, _direct_activity} = CommonAPI.post(user, %{status: ".", visibility: "direct"})

      conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_visibilities[]=direct")
      assert [%{"id" => ^public_activity_id}] = json_response_and_validate_schema(conn, 200)
    end

    test "muted reactions", %{user: user, conn: conn} do
      user2 = insert(:user)
      User.mute(user, user2)
      {:ok, activity} = CommonAPI.post(user, %{status: "."})
      {:ok, _} = CommonAPI.react_with_emoji(activity.id, user2, "🎅")

      result =
        conn
        |> get("/api/v1/accounts/#{user.id}/statuses")
        |> json_response_and_validate_schema(200)

      assert [
               %{
                 "pleroma" => %{
                   "emoji_reactions" => []
                 }
               }
             ] = result

      result =
        conn
        |> get("/api/v1/accounts/#{user.id}/statuses?with_muted=true")
        |> json_response_and_validate_schema(200)

      assert [
               %{
                 "pleroma" => %{
                   "emoji_reactions" => [%{"count" => 1, "me" => false, "name" => "🎅"}]
                 }
               }
             ] = result
    end

    test "paginates a user's statuses", %{user: user, conn: conn} do
      {:ok, post_1} = CommonAPI.post(user, %{status: "first post"})
      {:ok, post_2} = CommonAPI.post(user, %{status: "second post"})

      response_1 = get(conn, "/api/v1/accounts/#{user.id}/statuses?limit=1")
      assert [res] = json_response_and_validate_schema(response_1, 200)
      assert res["id"] == post_2.id

      response_2 = get(conn, "/api/v1/accounts/#{user.id}/statuses?limit=1&max_id=#{res["id"]}")
      assert [res] = json_response_and_validate_schema(response_2, 200)
      assert res["id"] == post_1.id

      refute response_1 == response_2
    end
  end

  defp local_and_remote_activities(%{local: local, remote: remote}) do
    insert(:note_activity, user: local)
    insert(:note_activity, user: remote, local: false)

    :ok
  end

  describe "statuses with restrict unauthenticated profiles for local and remote" do
    setup do: local_and_remote_users()
    setup :local_and_remote_activities

    setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)

    setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)

    test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
      assert %{"error" => "This API requires an authenticated user"} ==
               conn
               |> get("/api/v1/accounts/#{local.id}/statuses")
               |> json_response_and_validate_schema(:unauthorized)

      assert %{"error" => "This API requires an authenticated user"} ==
               conn
               |> get("/api/v1/accounts/#{remote.id}/statuses")
               |> json_response_and_validate_schema(:unauthorized)
    end

    test "if user is authenticated", %{local: local, remote: remote} do
      %{conn: conn} = oauth_access(["read"])

      res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
      assert length(json_response_and_validate_schema(res_conn, 200)) == 1

      res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
      assert length(json_response_and_validate_schema(res_conn, 200)) == 1
    end
  end

  describe "statuses with restrict unauthenticated profiles for local" do
    setup do: local_and_remote_users()
    setup :local_and_remote_activities

    setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)

    test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
      assert %{"error" => "This API requires an authenticated user"} ==
               conn
               |> get("/api/v1/accounts/#{local.id}/statuses")
               |> json_response_and_validate_schema(:unauthorized)

      res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
      assert length(json_response_and_validate_schema(res_conn, 200)) == 1
    end

    test "if user is authenticated", %{local: local, remote: remote} do
      %{conn: conn} = oauth_access(["read"])

      res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
      assert length(json_response_and_validate_schema(res_conn, 200)) == 1

      res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
      assert length(json_response_and_validate_schema(res_conn, 200)) == 1
    end
  end

  describe "statuses with restrict unauthenticated profiles for remote" do
    setup do: local_and_remote_users()
    setup :local_and_remote_activities

    setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)

    test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
      res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
      assert length(json_response_and_validate_schema(res_conn, 200)) == 1

      assert %{"error" => "This API requires an authenticated user"} ==
               conn
               |> get("/api/v1/accounts/#{remote.id}/statuses")
               |> json_response_and_validate_schema(:unauthorized)
    end

    test "if user is authenticated", %{local: local, remote: remote} do
      %{conn: conn} = oauth_access(["read"])

      res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
      assert length(json_response_and_validate_schema(res_conn, 200)) == 1

      res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
      assert length(json_response_and_validate_schema(res_conn, 200)) == 1
    end
  end

  describe "followers" do
    setup do: oauth_access(["read:accounts"])

    test "getting followers", %{user: user, conn: conn} do
      other_user = insert(:user)
      {:ok, %{id: user_id}, other_user} = User.follow(user, other_user)

      conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")

      assert [%{"id" => ^user_id}] = json_response_and_validate_schema(conn, 200)
    end

    test "following with relationship", %{conn: conn, user: user} do
      other_user = insert(:user)
      {:ok, %{id: id}, _} = User.follow(other_user, user)

      assert [
               %{
                 "id" => ^id,
                 "pleroma" => %{
                   "relationship" => %{
                     "id" => ^id,
                     "following" => false,
                     "followed_by" => true
                   }
                 }
               }
             ] =
               conn
               |> get("/api/v1/accounts/#{user.id}/followers?with_relationships=true")
               |> json_response_and_validate_schema(200)

      {:ok, _, _} = User.follow(user, other_user)

      assert [
               %{
                 "id" => ^id,
                 "pleroma" => %{
                   "relationship" => %{
                     "id" => ^id,
                     "following" => true,
                     "followed_by" => true
                   }
                 }
               }
             ] =
               conn
               |> get("/api/v1/accounts/#{user.id}/followers?with_relationships=true")
               |> json_response_and_validate_schema(200)
    end

    test "getting followers, hide_followers", %{user: user, conn: conn} do
      other_user = insert(:user, hide_followers: true)
      {:ok, _user, _other_user} = User.follow(user, other_user)

      conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")

      assert [] == json_response_and_validate_schema(conn, 200)
    end

    test "getting followers, hide_followers, same user requesting" do
      user = insert(:user)
      other_user = insert(:user, hide_followers: true)
      {:ok, _user, _other_user} = User.follow(user, other_user)

      conn =
        build_conn()
        |> assign(:user, other_user)
        |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
        |> get("/api/v1/accounts/#{other_user.id}/followers")

      refute [] == json_response_and_validate_schema(conn, 200)
    end

    test "getting followers, pagination", %{user: user, conn: conn} do
      {:ok, %User{id: follower1_id}, _user} = :user |> insert() |> User.follow(user)
      {:ok, %User{id: follower2_id}, _user} = :user |> insert() |> User.follow(user)
      {:ok, %User{id: follower3_id}, _user} = :user |> insert() |> User.follow(user)

      assert [%{"id" => ^follower3_id}, %{"id" => ^follower2_id}] =
               conn
               |> get("/api/v1/accounts/#{user.id}/followers?since_id=#{follower1_id}")
               |> json_response_and_validate_schema(200)

      assert [%{"id" => ^follower2_id}, %{"id" => ^follower1_id}] =
               conn
               |> get("/api/v1/accounts/#{user.id}/followers?max_id=#{follower3_id}")
               |> json_response_and_validate_schema(200)

      assert [%{"id" => ^follower2_id}, %{"id" => ^follower1_id}] =
               conn
               |> get(
                 "/api/v1/accounts/#{user.id}/followers?id=#{user.id}&limit=20&max_id=#{follower3_id}"
               )
               |> json_response_and_validate_schema(200)

      res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?limit=1&max_id=#{follower3_id}")

      assert [%{"id" => ^follower2_id}] = json_response_and_validate_schema(res_conn, 200)

      assert [link_header] = get_resp_header(res_conn, "link")
      assert link_header =~ ~r/min_id=#{follower2_id}/
      assert link_header =~ ~r/max_id=#{follower2_id}/
    end
  end

  describe "following" do
    setup do: oauth_access(["read:accounts"])

    test "getting following", %{user: user, conn: conn} do
      other_user = insert(:user)
      {:ok, user, other_user} = User.follow(user, other_user)

      conn = get(conn, "/api/v1/accounts/#{user.id}/following")

      assert [%{"id" => id}] = json_response_and_validate_schema(conn, 200)
      assert id == to_string(other_user.id)
    end

    test "following with relationship", %{conn: conn, user: user} do
      other_user = insert(:user)
      {:ok, user, other_user} = User.follow(user, other_user)

      conn = get(conn, "/api/v1/accounts/#{user.id}/following?with_relationships=true")

      id = other_user.id

      assert [
               %{
                 "id" => ^id,
                 "pleroma" => %{
                   "relationship" => %{"id" => ^id, "following" => true, "followed_by" => false}
                 }
               }
             ] = json_response_and_validate_schema(conn, 200)
    end

    test "getting following, hide_follows, other user requesting" do
      user = insert(:user, hide_follows: true)
      other_user = insert(:user)
      {:ok, user, other_user} = User.follow(user, other_user)

      conn =
        build_conn()
        |> assign(:user, other_user)
        |> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
        |> get("/api/v1/accounts/#{user.id}/following")

      assert [] == json_response_and_validate_schema(conn, 200)
    end

    test "getting following, hide_follows, same user requesting" do
      user = insert(:user, hide_follows: true)
      other_user = insert(:user)
      {:ok, user, _other_user} = User.follow(user, other_user)

      conn =
        build_conn()
        |> assign(:user, user)
        |> assign(:token, insert(:oauth_token, user: user, scopes: ["read:accounts"]))
        |> get("/api/v1/accounts/#{user.id}/following")

      refute [] == json_response_and_validate_schema(conn, 200)
    end

    test "getting following, pagination", %{user: user, conn: conn} do
      following1 = insert(:user)
      following2 = insert(:user)
      following3 = insert(:user)
      {:ok, _, _} = User.follow(user, following1)
      {:ok, _, _} = User.follow(user, following2)
      {:ok, _, _} = User.follow(user, following3)

      res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?since_id=#{following1.id}")

      assert [%{"id" => id3}, %{"id" => id2}] = json_response_and_validate_schema(res_conn, 200)
      assert id3 == following3.id
      assert id2 == following2.id

      res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?max_id=#{following3.id}")

      assert [%{"id" => id2}, %{"id" => id1}] = json_response_and_validate_schema(res_conn, 200)
      assert id2 == following2.id
      assert id1 == following1.id

      res_conn =
        get(
          conn,
          "/api/v1/accounts/#{user.id}/following?id=#{user.id}&limit=20&max_id=#{following3.id}"
        )

      assert [%{"id" => id2}, %{"id" => id1}] = json_response_and_validate_schema(res_conn, 200)
      assert id2 == following2.id
      assert id1 == following1.id

      res_conn =
        get(conn, "/api/v1/accounts/#{user.id}/following?limit=1&max_id=#{following3.id}")

      assert [%{"id" => id2}] = json_response_and_validate_schema(res_conn, 200)
      assert id2 == following2.id

      assert [link_header] = get_resp_header(res_conn, "link")
      assert link_header =~ ~r/min_id=#{following2.id}/
      assert link_header =~ ~r/max_id=#{following2.id}/
    end
  end

  describe "follow/unfollow" do
    setup do: oauth_access(["follow"])

    test "following / unfollowing a user", %{conn: conn} do
      %{id: other_user_id, nickname: other_user_nickname} = insert(:user)

      assert %{"id" => _id, "following" => true} =
               conn
               |> post("/api/v1/accounts/#{other_user_id}/follow")
               |> json_response_and_validate_schema(200)

      assert %{"id" => _id, "following" => false} =
               conn
               |> post("/api/v1/accounts/#{other_user_id}/unfollow")
               |> json_response_and_validate_schema(200)

      assert %{"id" => ^other_user_id} =
               conn
               |> put_req_header("content-type", "application/json")
               |> post("/api/v1/follows", %{"uri" => other_user_nickname})
               |> json_response_and_validate_schema(200)
    end

    test "cancelling follow request", %{conn: conn} do
      %{id: other_user_id} = insert(:user, %{is_locked: true})

      assert %{"id" => ^other_user_id, "following" => false, "requested" => true} =
               conn
               |> post("/api/v1/accounts/#{other_user_id}/follow")
               |> json_response_and_validate_schema(:ok)

      assert %{"id" => ^other_user_id, "following" => false, "requested" => false} =
               conn
               |> post("/api/v1/accounts/#{other_user_id}/unfollow")
               |> json_response_and_validate_schema(:ok)
    end

    test "following without reblogs" do
      %{conn: conn} = oauth_access(["follow", "read:statuses"])
      followed = insert(:user)
      other_user = insert(:user)

      ret_conn =
        conn
        |> put_req_header("content-type", "application/json")
        |> post("/api/v1/accounts/#{followed.id}/follow", %{reblogs: false})

      assert %{"showing_reblogs" => false} = json_response_and_validate_schema(ret_conn, 200)

      {:ok, activity} = CommonAPI.post(other_user, %{status: "hey"})
      {:ok, %{id: reblog_id}} = CommonAPI.repeat(activity.id, followed)

      assert [] ==
               conn
               |> get("/api/v1/timelines/home")
               |> json_response_and_validate_schema(200)

      assert %{"showing_reblogs" => true} =
               conn
               |> put_req_header("content-type", "application/json")
               |> post("/api/v1/accounts/#{followed.id}/follow", %{reblogs: true})
               |> json_response_and_validate_schema(200)

      assert %{"showing_reblogs" => true} =
               conn
               |> put_req_header("content-type", "application/json")
               |> post("/api/v1/accounts/#{followed.id}/follow", %{reblogs: "1"})
               |> json_response_and_validate_schema(200)

      assert [%{"id" => ^reblog_id}] =
               conn
               |> get("/api/v1/timelines/home")
               |> json_response_and_validate_schema(200)
    end

    test "following with reblogs" do
      %{conn: conn} = oauth_access(["follow", "read:statuses"])
      followed = insert(:user)
      other_user = insert(:user)

      ret_conn = post(conn, "/api/v1/accounts/#{followed.id}/follow")

      assert %{"showing_reblogs" => true} = json_response_and_validate_schema(ret_conn, 200)

      {:ok, activity} = CommonAPI.post(other_user, %{status: "hey"})
      {:ok, %{id: reblog_id}} = CommonAPI.repeat(activity.id, followed)

      assert [%{"id" => ^reblog_id}] =
               conn
               |> get("/api/v1/timelines/home")
               |> json_response_and_validate_schema(200)

      assert %{"showing_reblogs" => false} =
               conn
               |> put_req_header("content-type", "application/json")
               |> post("/api/v1/accounts/#{followed.id}/follow", %{reblogs: false})
               |> json_response_and_validate_schema(200)

      assert %{"showing_reblogs" => false} =
               conn
               |> put_req_header("content-type", "application/json")
               |> post("/api/v1/accounts/#{followed.id}/follow", %{reblogs: "0"})
               |> json_response_and_validate_schema(200)

      assert [] ==
               conn
               |> get("/api/v1/timelines/home")
               |> json_response_and_validate_schema(200)
    end

    test "following with subscription and unsubscribing" do
      %{conn: conn} = oauth_access(["follow"])
      followed = insert(:user)

      assert %{"subscribing" => true} =
               conn
               |> put_req_header("content-type", "application/json")
               |> post("/api/v1/accounts/#{followed.id}/follow", %{notify: true})
               |> json_response_and_validate_schema(200)

      assert %{"subscribing" => true} =
               conn
               |> put_req_header("content-type", "application/json")
               |> post("/api/v1/accounts/#{followed.id}/follow", %{notify: "1"})
               |> json_response_and_validate_schema(200)

      assert %{"subscribing" => false} =
               conn
               |> put_req_header("content-type", "application/json")
               |> post("/api/v1/accounts/#{followed.id}/follow", %{notify: false})
               |> json_response_and_validate_schema(200)
    end

    test "following / unfollowing errors", %{user: user, conn: conn} do
      # self follow
      conn_res = post(conn, "/api/v1/accounts/#{user.id}/follow")

      assert %{"error" => "Can not follow yourself"} =
               json_response_and_validate_schema(conn_res, 400)

      # self unfollow
      user = User.get_cached_by_id(user.id)
      conn_res = post(conn, "/api/v1/accounts/#{user.id}/unfollow")

      assert %{"error" => "Can not unfollow yourself"} =
               json_response_and_validate_schema(conn_res, 400)

      # self follow via uri
      user = User.get_cached_by_id(user.id)

      assert %{"error" => "Can not follow yourself"} =
               conn
               |> put_req_header("content-type", "multipart/form-data")
               |> post("/api/v1/follows", %{"uri" => user.nickname})
               |> json_response_and_validate_schema(400)

      # follow non existing user
      conn_res = post(conn, "/api/v1/accounts/doesntexist/follow")
      assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)

      # follow non existing user via uri
      conn_res =
        conn
        |> put_req_header("content-type", "multipart/form-data")
        |> post("/api/v1/follows", %{"uri" => "doesntexist"})

      assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)

      # unfollow non existing user
      conn_res = post(conn, "/api/v1/accounts/doesntexist/unfollow")
      assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)
    end
  end

  describe "mute/unmute" do
    setup do: oauth_access(["write:mutes"])

    test "with notifications", %{conn: conn} do
      other_user = insert(:user)

      assert %{"id" => _id, "muting" => true, "muting_notifications" => true} =
               conn
               |> post("/api/v1/accounts/#{other_user.id}/mute")
               |> json_response_and_validate_schema(200)

      conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")

      assert %{"id" => _id, "muting" => false, "muting_notifications" => false} =
               json_response_and_validate_schema(conn, 200)
    end

    test "without notifications", %{conn: conn} do
      other_user = insert(:user)

      ret_conn =
        conn
        |> put_req_header("content-type", "multipart/form-data")
        |> post("/api/v1/accounts/#{other_user.id}/mute", %{"notifications" => "false"})

      assert %{"id" => _id, "muting" => true, "muting_notifications" => false} =
               json_response_and_validate_schema(ret_conn, 200)

      conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")

      assert %{"id" => _id, "muting" => false, "muting_notifications" => false} =
               json_response_and_validate_schema(conn, 200)
    end

    test "expiring", %{conn: conn, user: user} do
      other_user = insert(:user)

      conn =
        conn
        |> put_req_header("content-type", "multipart/form-data")
        |> post("/api/v1/accounts/#{other_user.id}/mute", %{"duration" => "86400"})

      assert %{"id" => _id, "muting" => true} = json_response_and_validate_schema(conn, 200)

      mute_expires_at = UserRelationship.get_mute_expire_date(user, other_user)

      assert DateTime.diff(
               mute_expires_at,
               DateTime.utc_now() |> DateTime.add(24 * 60 * 60)
             ) in -3..3
    end

    test "falls back to expires_in", %{conn: conn, user: user} do
      other_user = insert(:user)

      conn
      |> put_req_header("content-type", "multipart/form-data")
      |> post("/api/v1/accounts/#{other_user.id}/mute", %{"expires_in" => "86400"})
      |> json_response_and_validate_schema(200)

      mute_expires_at = UserRelationship.get_mute_expire_date(user, other_user)

      assert DateTime.diff(
               mute_expires_at,
               DateTime.utc_now() |> DateTime.add(24 * 60 * 60)
             ) in -3..3
    end
  end

  describe "pinned statuses" do
    setup do
      user = insert(:user)
      {:ok, activity} = CommonAPI.post(user, %{status: "HI!!!"})
      %{conn: conn} = oauth_access(["read:statuses"], user: user)

      [conn: conn, user: user, activity: activity]
    end

    test "returns pinned statuses", %{conn: conn, user: user, activity: %{id: activity_id}} do
      {:ok, _} = CommonAPI.pin(activity_id, user)

      assert [%{"id" => ^activity_id, "pinned" => true}] =
               conn
               |> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
               |> json_response_and_validate_schema(200)
    end
  end

  test "view pinned private statuses" do
    user = insert(:user)
    reader = insert(:user)

    # Create a private status and pin it
    {:ok, %{id: activity_id} = activity} =
      CommonAPI.post(user, %{status: "psst", visibility: "private"})

    %{data: %{"id" => object_ap_id}} = Object.normalize(activity)
    {:ok, _} = User.add_pinned_object_id(user, object_ap_id)

    %{conn: conn} = oauth_access(["read:statuses"], user: reader)

    # A non-follower can't see the pinned status
    assert [] ==
             conn
             |> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
             |> json_response_and_validate_schema(200)

    # Follow the user, then the pinned status can be seen
    CommonAPI.follow(reader, user)
    ObanHelpers.perform_all()

    assert [%{"id" => ^activity_id, "pinned" => true}] =
             conn
             |> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
             |> json_response_and_validate_schema(200)
  end

  test "blocking / unblocking a user" do
    %{conn: conn} = oauth_access(["follow"])
    other_user = insert(:user)

    ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/block")

    assert %{"id" => _id, "blocking" => true} = json_response_and_validate_schema(ret_conn, 200)

    conn = post(conn, "/api/v1/accounts/#{other_user.id}/unblock")

    assert %{"id" => _id, "blocking" => false} = json_response_and_validate_schema(conn, 200)
  end

  describe "create account by app" do
    setup do
      valid_params = %{
        username: "lain",
        email: "lain@example.org",
        password: "PlzDontHackLain",
        agreement: true
      }

      [valid_params: valid_params]
    end

    test "registers and logs in without :account_activation_required / :account_approval_required",
         %{conn: conn} do
      clear_config([:instance, :account_activation_required], false)
      clear_config([:instance, :account_approval_required], false)

      conn =
        conn
        |> put_req_header("content-type", "application/json")
        |> post("/api/v1/apps", %{
          client_name: "client_name",
          redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
          scopes: "read, write, follow"
        })

      assert %{
               "client_id" => client_id,
               "client_secret" => client_secret,
               "id" => _,
               "name" => "client_name",
               "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
               "vapid_key" => _,
               "website" => nil
             } = json_response_and_validate_schema(conn, 200)

      conn =
        post(conn, "/oauth/token", %{
          grant_type: "client_credentials",
          client_id: client_id,
          client_secret: client_secret
        })

      assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
               json_response(conn, 200)

      assert token
      token_from_db = Repo.get_by(Token, token: token)
      assert token_from_db
      assert refresh
      assert scope == "read write follow"

      clear_config([User, :email_blacklist], ["example.org"])

      params = %{
        username: "lain",
        email: "lain@example.org",
        password: "PlzDontHackLain",
        bio: "Test Bio",
        agreement: true
      }

      conn =
        build_conn()
        |> put_req_header("content-type", "multipart/form-data")
        |> put_req_header("authorization", "Bearer " <> token)
        |> post("/api/v1/accounts", params)

      assert %{"error" => "{\"email\":[\"Invalid email\"]}"} =
               json_response_and_validate_schema(conn, 400)

      clear_config([User, :email_blacklist], [])

      conn =
        build_conn()
        |> put_req_header("content-type", "multipart/form-data")
        |> put_req_header("authorization", "Bearer " <> token)
        |> post("/api/v1/accounts", params)

      %{
        "access_token" => token,
        "created_at" => _created_at,
        "scope" => ^scope,
        "token_type" => "Bearer"
      } = json_response_and_validate_schema(conn, 200)

      token_from_db = Repo.get_by(Token, token: token)
      assert token_from_db
      user = Repo.preload(token_from_db, :user).user

      assert user
      assert user.is_confirmed
      assert user.is_approved
    end

    test "registers but does not log in with :account_activation_required", %{conn: conn} do
      clear_config([:instance, :account_activation_required], true)
      clear_config([:instance, :account_approval_required], false)

      conn =
        conn
        |> put_req_header("content-type", "application/json")
        |> post("/api/v1/apps", %{
          client_name: "client_name",
          redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
          scopes: "read, write, follow"
        })

      assert %{
               "client_id" => client_id,
               "client_secret" => client_secret,
               "id" => _,
               "name" => "client_name",
               "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
               "vapid_key" => _,
               "website" => nil
             } = json_response_and_validate_schema(conn, 200)

      conn =
        post(conn, "/oauth/token", %{
          grant_type: "client_credentials",
          client_id: client_id,
          client_secret: client_secret
        })

      assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
               json_response(conn, 200)

      assert token
      token_from_db = Repo.get_by(Token, token: token)
      assert token_from_db
      assert refresh
      assert scope == "read write follow"

      conn =
        build_conn()
        |> put_req_header("content-type", "multipart/form-data")
        |> put_req_header("authorization", "Bearer " <> token)
        |> post("/api/v1/accounts", %{
          username: "lain",
          email: "lain@example.org",
          password: "PlzDontHackLain",
          bio: "Test Bio",
          agreement: true
        })

      response = json_response_and_validate_schema(conn, 200)
      assert %{"identifier" => "missing_confirmed_email"} = response
      refute response["access_token"]
      refute response["token_type"]

      user = Repo.get_by(User, email: "lain@example.org")
      refute user.is_confirmed
    end

    test "registers but does not log in with :account_approval_required", %{conn: conn} do
      clear_config([:instance, :account_approval_required], true)
      clear_config([:instance, :account_activation_required], false)

      conn =
        conn
        |> put_req_header("content-type", "application/json")
        |> post("/api/v1/apps", %{
          client_name: "client_name",
          redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
          scopes: "read, write, follow"
        })

      assert %{
               "client_id" => client_id,
               "client_secret" => client_secret,
               "id" => _,
               "name" => "client_name",
               "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
               "vapid_key" => _,
               "website" => nil
             } = json_response_and_validate_schema(conn, 200)

      conn =
        post(conn, "/oauth/token", %{
          grant_type: "client_credentials",
          client_id: client_id,
          client_secret: client_secret
        })

      assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
               json_response(conn, 200)

      assert token
      token_from_db = Repo.get_by(Token, token: token)
      assert token_from_db
      assert refresh
      assert scope == "read write follow"

      conn =
        build_conn()
        |> put_req_header("content-type", "multipart/form-data")
        |> put_req_header("authorization", "Bearer " <> token)
        |> post("/api/v1/accounts", %{
          username: "lain",
          email: "lain@example.org",
          password: "PlzDontHackLain",
          bio: "Test Bio",
          agreement: true,
          reason: "I'm a cool dude, bro"
        })

      response = json_response_and_validate_schema(conn, 200)
      assert %{"identifier" => "awaiting_approval"} = response
      refute response["access_token"]
      refute response["token_type"]

      user = Repo.get_by(User, email: "lain@example.org")

      refute user.is_approved
      assert user.registration_reason == "I'm a cool dude, bro"
    end

    test "returns error when user already registered", %{conn: conn, valid_params: valid_params} do
      _user = insert(:user, email: "lain@example.org")
      app_token = insert(:oauth_token, user: nil)

      res =
        conn
        |> put_req_header("authorization", "Bearer " <> app_token.token)
        |> put_req_header("content-type", "application/json")
        |> post("/api/v1/accounts", valid_params)

      assert json_response_and_validate_schema(res, 400) == %{
               "error" => "{\"email\":[\"has already been taken\"]}"
             }
    end

    test "returns bad_request if missing required params", %{
      conn: conn,
      valid_params: valid_params
    } do
      app_token = insert(:oauth_token, user: nil)

      conn =
        conn
        |> put_req_header("authorization", "Bearer " <> app_token.token)
        |> put_req_header("content-type", "application/json")

      res = post(conn, "/api/v1/accounts", valid_params)
      assert json_response_and_validate_schema(res, 200)

      [{127, 0, 0, 1}, {127, 0, 0, 2}, {127, 0, 0, 3}, {127, 0, 0, 4}]
      |> Stream.zip(Map.delete(valid_params, :email))
      |> Enum.each(fn {ip, {attr, _}} ->
        res =
          conn
          |> Map.put(:remote_ip, ip)
          |> post("/api/v1/accounts", Map.delete(valid_params, attr))
          |> json_response_and_validate_schema(400)

        assert res == %{
                 "error" => "Missing field: #{attr}.",
                 "errors" => [
                   %{
                     "message" => "Missing field: #{attr}",
                     "source" => %{"pointer" => "/#{attr}"},
                     "title" => "Invalid value"
                   }
                 ]
               }
      end)
    end

    test "returns bad_request if missing email params when :account_activation_required is enabled",
         %{conn: conn, valid_params: valid_params} do
      clear_config([:instance, :account_activation_required], true)

      app_token = insert(:oauth_token, user: nil)

      conn =
        conn
        |> put_req_header("authorization", "Bearer " <> app_token.token)
        |> put_req_header("content-type", "application/json")

      res =
        conn
        |> Map.put(:remote_ip, {127, 0, 0, 5})
        |> post("/api/v1/accounts", Map.delete(valid_params, :email))

      assert json_response_and_validate_schema(res, 400) ==
               %{"error" => "Missing parameter: email"}

      res =
        conn
        |> Map.put(:remote_ip, {127, 0, 0, 6})
        |> post("/api/v1/accounts", Map.put(valid_params, :email, ""))

      assert json_response_and_validate_schema(res, 400) == %{
               "error" => "{\"email\":[\"can't be blank\"]}"
             }
    end

    test "allow registration without an email", %{conn: conn, valid_params: valid_params} do
      app_token = insert(:oauth_token, user: nil)
      conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)

      res =
        conn
        |> put_req_header("content-type", "application/json")
        |> Map.put(:remote_ip, {127, 0, 0, 7})
        |> post("/api/v1/accounts", Map.delete(valid_params, :email))

      assert json_response_and_validate_schema(res, 200)
    end

    test "allow registration with an empty email", %{conn: conn, valid_params: valid_params} do
      app_token = insert(:oauth_token, user: nil)
      conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)

      res =
        conn
        |> put_req_header("content-type", "application/json")
        |> Map.put(:remote_ip, {127, 0, 0, 8})
        |> post("/api/v1/accounts", Map.put(valid_params, :email, ""))

      assert json_response_and_validate_schema(res, 200)
    end

    test "returns forbidden if token is invalid", %{conn: conn, valid_params: valid_params} do
      res =
        conn
        |> put_req_header("authorization", "Bearer " <> "invalid-token")
        |> put_req_header("content-type", "multipart/form-data")
        |> post("/api/v1/accounts", valid_params)

      assert json_response_and_validate_schema(res, 403) == %{"error" => "Invalid credentials"}
    end

    test "registration from trusted app" do
      clear_config([Pleroma.Captcha, :enabled], true)
      app = insert(:oauth_app, trusted: true, scopes: ["read", "write", "follow", "push"])

      conn =
        build_conn()
        |> post("/oauth/token", %{
          "grant_type" => "client_credentials",
          "client_id" => app.client_id,
          "client_secret" => app.client_secret
        })

      assert %{"access_token" => token, "token_type" => "Bearer"} = json_response(conn, 200)

      response =
        build_conn()
        |> Plug.Conn.put_req_header("authorization", "Bearer " <> token)
        |> put_req_header("content-type", "multipart/form-data")
        |> post("/api/v1/accounts", %{
          nickname: "nickname",
          agreement: true,
          email: "email@example.com",
          fullname: "Lain",
          username: "Lain",
          password: "some_password",
          confirm: "some_password"
        })
        |> json_response_and_validate_schema(200)

      assert %{
               "access_token" => access_token,
               "created_at" => _,
               "scope" => "read write follow push",
               "token_type" => "Bearer"
             } = response

      response =
        build_conn()
        |> Plug.Conn.put_req_header("authorization", "Bearer " <> access_token)
        |> get("/api/v1/accounts/verify_credentials")
        |> json_response_and_validate_schema(200)

      assert %{
               "acct" => "Lain",
               "bot" => false,
               "display_name" => "Lain",
               "follow_requests_count" => 0,
               "followers_count" => 0,
               "following_count" => 0,
               "locked" => false,
               "note" => "",
               "source" => %{
                 "fields" => [],
                 "note" => "",
                 "pleroma" => %{
                   "actor_type" => "Person",
                   "discoverable" => false,
                   "no_rich_text" => false,
                   "show_role" => true
                 },
                 "privacy" => "public",
                 "sensitive" => false
               },
               "statuses_count" => 0,
               "username" => "Lain"
             } = response
    end
  end

  describe "create account by app / rate limit" do
    setup do: clear_config([:rate_limit, :app_account_creation], {10_000, 2})

    test "respects rate limit setting", %{conn: conn} do
      app_token = insert(:oauth_token, user: nil)

      conn =
        conn
        |> put_req_header("authorization", "Bearer " <> app_token.token)
        |> Map.put(:remote_ip, {15, 15, 15, 15})
        |> put_req_header("content-type", "multipart/form-data")

      for i <- 1..2 do
        conn =
          conn
          |> post("/api/v1/accounts", %{
            username: "#{i}lain",
            email: "#{i}lain@example.org",
            password: "PlzDontHackLain",
            agreement: true
          })

        %{
          "access_token" => token,
          "created_at" => _created_at,
          "scope" => _scope,
          "token_type" => "Bearer"
        } = json_response_and_validate_schema(conn, 200)

        token_from_db = Repo.get_by(Token, token: token)
        assert token_from_db
        token_from_db = Repo.preload(token_from_db, :user)
        assert token_from_db.user
      end

      conn =
        post(conn, "/api/v1/accounts", %{
          username: "6lain",
          email: "6lain@example.org",
          password: "PlzDontHackLain",
          agreement: true
        })

      assert json_response_and_validate_schema(conn, :too_many_requests) == %{
               "error" => "Throttled"
             }
    end
  end

  describe "create account with enabled captcha" do
    setup %{conn: conn} do
      app_token = insert(:oauth_token, user: nil)

      conn =
        conn
        |> put_req_header("authorization", "Bearer " <> app_token.token)
        |> put_req_header("content-type", "multipart/form-data")

      [conn: conn]
    end

    setup do: clear_config([Pleroma.Captcha, :enabled], true)

    test "creates an account and returns 200 if captcha is valid", %{conn: conn} do
      %{token: token, answer_data: answer_data} = Pleroma.Captcha.new()

      params = %{
        username: "lain",
        email: "lain@example.org",
        password: "PlzDontHackLain",
        agreement: true,
        captcha_solution: Pleroma.Captcha.Mock.solution(),
        captcha_token: token,
        captcha_answer_data: answer_data
      }

      assert %{
               "access_token" => access_token,
               "created_at" => _,
               "scope" => "read",
               "token_type" => "Bearer"
             } =
               conn
               |> post("/api/v1/accounts", params)
               |> json_response_and_validate_schema(:ok)

      assert Token |> Repo.get_by(token: access_token) |> Repo.preload(:user) |> Map.get(:user)
    end

    test "returns 400 if any captcha field is not provided", %{conn: conn} do
      captcha_fields = [:captcha_solution, :captcha_token, :captcha_answer_data]

      valid_params = %{
        username: "lain",
        email: "lain@example.org",
        password: "PlzDontHackLain",
        agreement: true,
        captcha_solution: "xx",
        captcha_token: "xx",
        captcha_answer_data: "xx"
      }

      for field <- captcha_fields do
        expected = %{
          "error" => "{\"captcha\":[\"Invalid CAPTCHA (Missing parameter: #{field})\"]}"
        }

        assert expected ==
                 conn
                 |> post("/api/v1/accounts", Map.delete(valid_params, field))
                 |> json_response_and_validate_schema(:bad_request)
      end
    end

    test "returns an error if captcha is invalid", %{conn: conn} do
      params = %{
        username: "lain",
        email: "lain@example.org",
        password: "PlzDontHackLain",
        agreement: true,
        captcha_solution: "cofe",
        captcha_token: "cofe",
        captcha_answer_data: "cofe"
      }

      assert %{"error" => "{\"captcha\":[\"Invalid answer data\"]}"} ==
               conn
               |> post("/api/v1/accounts", params)
               |> json_response_and_validate_schema(:bad_request)
    end
  end

  describe "create account with required birth date" do
    setup %{conn: conn} do
      clear_config([:instance, :birthday_required], true)
      clear_config([:instance, :birthday_min_age], 18 * 365)

      app_token = insert(:oauth_token, user: nil)

      conn =
        conn
        |> put_req_header("authorization", "Bearer " <> app_token.token)
        |> put_req_header("content-type", "multipart/form-data")

      [conn: conn]
    end

    test "creates an account if provided valid birth date", %{conn: conn} do
      birthday =
        Date.utc_today()
        |> Date.add(-19 * 365)
        |> Date.to_string()

      params = %{
        username: "mkljczk",
        email: "mkljczk@example.org",
        password: "dupa.8",
        agreement: true,
        birthday: birthday
      }

      res =
        conn
        |> post("/api/v1/accounts", params)

      assert json_response_and_validate_schema(res, 200)
    end

    test "returns an error if missing birth date", %{conn: conn} do
      params = %{
        username: "mkljczk",
        email: "mkljczk@example.org",
        password: "dupa.8",
        agreement: true
      }

      res =
        conn
        |> post("/api/v1/accounts", params)

      assert json_response_and_validate_schema(res, 400) == %{
               "error" => "{\"birthday\":[\"can't be blank\"]}"
             }
    end
  end

  describe "create account with language" do
    setup %{conn: conn} do
      app_token = insert(:oauth_token, user: nil)

      conn =
        conn
        |> put_req_header("authorization", "Bearer " <> app_token.token)
        |> put_req_header("content-type", "multipart/form-data")
        |> put_req_cookie(SetLocalePlug.frontend_language_cookie_name(), "zh-Hans")
        |> SetLocalePlug.call([])

      [conn: conn]
    end

    test "creates an account with language parameter", %{conn: conn} do
      params = %{
        username: "foo",
        email: "foo@example.org",
        password: "dupa.8",
        agreement: true,
        language: "ru"
      }

      res =
        conn
        |> post("/api/v1/accounts", params)

      assert json_response_and_validate_schema(res, 200)

      assert %{language: "ru"} = Pleroma.User.get_by_nickname("foo")
    end

    test "language parameter should be normalized", %{conn: conn} do
      params = %{
        username: "foo",
        email: "foo@example.org",
        password: "dupa.8",
        agreement: true,
        language: "ru-RU"
      }

      res =
        conn
        |> post("/api/v1/accounts", params)

      assert json_response_and_validate_schema(res, 200)

      assert %{language: "ru_RU"} = Pleroma.User.get_by_nickname("foo")
    end

    test "creating an account without language parameter should fallback to cookie/header language",
         %{conn: conn} do
      params = %{
        username: "foo2",
        email: "foo2@example.org",
        password: "dupa.8",
        agreement: true
      }

      res =
        conn
        |> post("/api/v1/accounts", params)

      assert json_response_and_validate_schema(res, 200)

      assert %{language: "zh_Hans"} = Pleroma.User.get_by_nickname("foo2")
    end
  end

  describe "GET /api/v1/accounts/:id/lists - account_lists" do
    test "returns lists to which the account belongs" do
      %{user: user, conn: conn} = oauth_access(["read:lists"])
      other_user = insert(:user)
      assert {:ok, %Pleroma.List{id: _list_id} = list} = Pleroma.List.create("Test List", user)
      {:ok, %{following: _following}} = Pleroma.List.follow(list, other_user)

      assert [%{"id" => _list_id, "title" => "Test List"}] =
               conn
               |> get("/api/v1/accounts/#{other_user.id}/lists")
               |> json_response_and_validate_schema(200)
    end
  end

  describe "verify_credentials" do
    test "verify_credentials" do
      %{user: user, conn: conn} = oauth_access(["read:accounts"])

      [notification | _] =
        insert_list(7, :notification, user: user, activity: insert(:note_activity))

      Pleroma.Notification.set_read_up_to(user, notification.id)
      conn = get(conn, "/api/v1/accounts/verify_credentials")

      response = json_response_and_validate_schema(conn, 200)

      assert %{"id" => id, "source" => %{"privacy" => "public"}} = response
      assert response["pleroma"]["chat_token"]
      assert response["pleroma"]["unread_notifications_count"] == 6
      assert id == to_string(user.id)
    end

    test "verify_credentials default scope unlisted" do
      user = insert(:user, default_scope: "unlisted")
      %{conn: conn} = oauth_access(["read:accounts"], user: user)

      conn = get(conn, "/api/v1/accounts/verify_credentials")

      assert %{"id" => id, "source" => %{"privacy" => "unlisted"}} =
               json_response_and_validate_schema(conn, 200)

      assert id == to_string(user.id)
    end

    test "locked accounts" do
      user = insert(:user, default_scope: "private")
      %{conn: conn} = oauth_access(["read:accounts"], user: user)

      conn = get(conn, "/api/v1/accounts/verify_credentials")

      assert %{"id" => id, "source" => %{"privacy" => "private"}} =
               json_response_and_validate_schema(conn, 200)

      assert id == to_string(user.id)
    end
  end

  describe "user relationships" do
    setup do: oauth_access(["read:follows"])

    test "returns the relationships for the current user", %{user: user, conn: conn} do
      %{id: other_user_id} = other_user = insert(:user)
      {:ok, _user, _other_user} = User.follow(user, other_user)

      assert [%{"id" => ^other_user_id}] =
               conn
               |> get("/api/v1/accounts/relationships?id=#{other_user.id}")
               |> json_response_and_validate_schema(200)

      assert [%{"id" => ^other_user_id}] =
               conn
               |> get("/api/v1/accounts/relationships?id[]=#{other_user.id}")
               |> json_response_and_validate_schema(200)
    end

    test "returns an empty list on a bad request", %{conn: conn} do
      conn = get(conn, "/api/v1/accounts/relationships", %{})

      assert [] = json_response_and_validate_schema(conn, 200)
    end
  end

  test "getting a list of mutes" do
    %{user: user, conn: conn} = oauth_access(["read:mutes"])
    %{id: id1} = other_user1 = insert(:user)
    %{id: id2} = other_user2 = insert(:user)
    %{id: id3} = other_user3 = insert(:user)

    {:ok, _user_relationships} = User.mute(user, other_user1)
    {:ok, _user_relationships} = User.mute(user, other_user2)
    {:ok, _user_relationships} = User.mute(user, other_user3)

    result =
      conn
      |> get("/api/v1/mutes")
      |> json_response_and_validate_schema(200)

    assert [id3, id2, id1] == Enum.map(result, & &1["id"])

    result =
      conn
      |> get("/api/v1/mutes?limit=1")
      |> json_response_and_validate_schema(200)

    assert [%{"id" => ^id3}] = result

    result =
      conn
      |> get("/api/v1/mutes?since_id=#{id1}")
      |> json_response_and_validate_schema(200)

    assert [%{"id" => ^id3}, %{"id" => ^id2}] = result

    result =
      conn
      |> get("/api/v1/mutes?since_id=#{id1}&max_id=#{id3}")
      |> json_response_and_validate_schema(200)

    assert [%{"id" => ^id2}] = result

    result =
      conn
      |> get("/api/v1/mutes?since_id=#{id1}&limit=1")
      |> json_response_and_validate_schema(200)

    assert [%{"id" => ^id3}] = result
  end

  test "list of mutes with with_relationships parameter" do
    %{user: user, conn: conn} = oauth_access(["read:mutes"])
    %{id: id1} = other_user1 = insert(:user)
    %{id: id2} = other_user2 = insert(:user)
    %{id: id3} = other_user3 = insert(:user)

    {:ok, _, _} = User.follow(other_user1, user)
    {:ok, _, _} = User.follow(other_user2, user)
    {:ok, _, _} = User.follow(other_user3, user)

    {:ok, _} = User.mute(user, other_user1)
    {:ok, _} = User.mute(user, other_user2)
    {:ok, _} = User.mute(user, other_user3)

    assert [
             %{
               "id" => ^id3,
               "pleroma" => %{"relationship" => %{"muting" => true, "followed_by" => true}}
             },
             %{
               "id" => ^id2,
               "pleroma" => %{"relationship" => %{"muting" => true, "followed_by" => true}}
             },
             %{
               "id" => ^id1,
               "pleroma" => %{"relationship" => %{"muting" => true, "followed_by" => true}}
             }
           ] =
             conn
             |> get("/api/v1/mutes?with_relationships=true")
             |> json_response_and_validate_schema(200)
  end

  test "getting a list of blocks" do
    %{user: user, conn: conn} = oauth_access(["read:blocks"])
    %{id: id1} = other_user1 = insert(:user)
    %{id: id2} = other_user2 = insert(:user)
    %{id: id3} = other_user3 = insert(:user)

    {:ok, _user_relationship} = User.block(user, other_user1)
    {:ok, _user_relationship} = User.block(user, other_user3)
    {:ok, _user_relationship} = User.block(user, other_user2)

    result =
      conn
      |> assign(:user, user)
      |> get("/api/v1/blocks")
      |> json_response_and_validate_schema(200)

    assert [id3, id2, id1] == Enum.map(result, & &1["id"])

    result =
      conn
      |> assign(:user, user)
      |> get("/api/v1/blocks?limit=1")
      |> json_response_and_validate_schema(200)

    assert [%{"id" => ^id3}] = result

    result =
      conn
      |> assign(:user, user)
      |> get("/api/v1/blocks?since_id=#{id1}")
      |> json_response_and_validate_schema(200)

    assert [%{"id" => ^id3}, %{"id" => ^id2}] = result

    result =
      conn
      |> assign(:user, user)
      |> get("/api/v1/blocks?since_id=#{id1}&max_id=#{id3}")
      |> json_response_and_validate_schema(200)

    assert [%{"id" => ^id2}] = result

    result =
      conn
      |> assign(:user, user)
      |> get("/api/v1/blocks?since_id=#{id1}&limit=1")
      |> json_response_and_validate_schema(200)

    assert [%{"id" => ^id3}] = result

    conn_res =
      conn
      |> assign(:user, user)
      |> get("/api/v1/blocks?limit=2")

    next_url =
      ~r{<.+?(?<link>/api[^>]+)>; rel=\"next\"}
      |> Regex.named_captures(get_resp_header(conn_res, "link") |> Enum.at(0))
      |> Map.get("link")

    result =
      conn_res
      |> json_response_and_validate_schema(200)

    assert [%{"id" => ^id3}, %{"id" => ^id2}] = result

    result =
      conn
      |> assign(:user, user)
      |> get(next_url)
      |> json_response_and_validate_schema(200)

    assert [%{"id" => ^id1}] = result
  end

  test "list of blocks with with_relationships parameter" do
    %{user: user, conn: conn} = oauth_access(["read:blocks"])
    %{id: id1} = other_user1 = insert(:user)
    %{id: id2} = other_user2 = insert(:user)
    %{id: id3} = other_user3 = insert(:user)

    {:ok, _, _} = User.follow(other_user1, user)
    {:ok, _, _} = User.follow(other_user2, user)
    {:ok, _, _} = User.follow(other_user3, user)

    {:ok, _} = User.block(user, other_user1)
    {:ok, _} = User.block(user, other_user2)
    {:ok, _} = User.block(user, other_user3)

    assert [
             %{
               "id" => ^id3,
               "pleroma" => %{"relationship" => %{"blocking" => true, "followed_by" => false}}
             },
             %{
               "id" => ^id2,
               "pleroma" => %{"relationship" => %{"blocking" => true, "followed_by" => false}}
             },
             %{
               "id" => ^id1,
               "pleroma" => %{"relationship" => %{"blocking" => true, "followed_by" => false}}
             }
           ] =
             conn
             |> get("/api/v1/blocks?with_relationships=true")
             |> json_response_and_validate_schema(200)
  end

  test "account lookup", %{conn: conn} do
    %{nickname: acct} = insert(:user, %{nickname: "nickname"})
    %{nickname: acct_two} = insert(:user, %{nickname: "nickname@notlocaldoma.in"})

    result =
      conn
      |> get("/api/v1/accounts/lookup?acct=#{acct}")
      |> json_response_and_validate_schema(200)

    assert %{"acct" => ^acct} = result

    result =
      conn
      |> get("/api/v1/accounts/lookup?acct=#{acct_two}")
      |> json_response_and_validate_schema(200)

    assert %{"acct" => ^acct_two} = result

    _result =
      conn
      |> get("/api/v1/accounts/lookup?acct=unexisting_nickname")
      |> json_response_and_validate_schema(404)
  end

  test "create a note on a user" do
    %{conn: conn} = oauth_access(["write:accounts", "read:follows"])
    other_user = insert(:user)

    conn
    |> put_req_header("content-type", "application/json")
    |> post("/api/v1/accounts/#{other_user.id}/note", %{
      "comment" => "Example note"
    })

    assert [%{"note" => "Example note"}] =
             conn
             |> put_req_header("content-type", "application/json")
             |> get("/api/v1/accounts/relationships?id=#{other_user.id}")
             |> json_response_and_validate_schema(200)
  end

  describe "account endorsements" do
    setup do: oauth_access(["read:accounts", "write:accounts", "write:follows"])

    setup do: clear_config([:instance, :max_endorsed_users], 1)

    test "pin account", %{user: user, conn: conn} do
      %{id: id1} = other_user1 = insert(:user)

      CommonAPI.follow(user, other_user1)

      assert %{"id" => ^id1, "endorsed" => true} =
               conn
               |> put_req_header("content-type", "application/json")
               |> post("/api/v1/accounts/#{id1}/pin")
               |> json_response_and_validate_schema(200)

      assert [%{"id" => ^id1}] =
               conn
               |> put_req_header("content-type", "application/json")
               |> get("/api/v1/endorsements")
               |> json_response_and_validate_schema(200)
    end

    test "unpin account", %{user: user, conn: conn} do
      %{id: id1} = other_user1 = insert(:user)

      CommonAPI.follow(user, other_user1)
      User.endorse(user, other_user1)

      assert %{"id" => ^id1, "endorsed" => false} =
               conn
               |> put_req_header("content-type", "application/json")
               |> post("/api/v1/accounts/#{id1}/unpin")
               |> json_response_and_validate_schema(200)

      assert [] =
               conn
               |> put_req_header("content-type", "application/json")
               |> get("/api/v1/endorsements")
               |> json_response_and_validate_schema(200)
    end

    test "max pinned accounts", %{user: user, conn: conn} do
      %{id: id1} = other_user1 = insert(:user)
      %{id: id2} = other_user2 = insert(:user)

      CommonAPI.follow(user, other_user1)
      CommonAPI.follow(user, other_user2)

      conn
      |> put_req_header("content-type", "application/json")
      |> post("/api/v1/accounts/#{id1}/pin")
      |> json_response_and_validate_schema(200)

      assert %{"error" => "You have already pinned the maximum number of users"} =
               conn
               |> assign(:user, user)
               |> post("/api/v1/accounts/#{id2}/pin")
               |> json_response_and_validate_schema(400)
    end
  end

  describe "remove from followers" do
    setup do: oauth_access(["follow"])

    test "removing user from followers", %{conn: conn, user: user} do
      %{id: other_user_id} = other_user = insert(:user)

      CommonAPI.follow(other_user, user)

      assert %{"id" => ^other_user_id, "followed_by" => false} =
               conn
               |> post("/api/v1/accounts/#{other_user_id}/remove_from_followers")
               |> json_response_and_validate_schema(200)

      refute User.following?(other_user, user)
    end

    test "removing remote user from followers", %{conn: conn, user: user} do
      %{id: other_user_id} = other_user = insert(:user, local: false)

      CommonAPI.follow(other_user, user)

      assert User.following?(other_user, user)

      assert %{"id" => ^other_user_id, "followed_by" => false} =
               conn
               |> post("/api/v1/accounts/#{other_user_id}/remove_from_followers")
               |> json_response_and_validate_schema(200)

      refute User.following?(other_user, user)
    end

    test "removing user from followers errors", %{user: user, conn: conn} do
      # self remove
      conn_res = post(conn, "/api/v1/accounts/#{user.id}/remove_from_followers")

      assert %{"error" => "Can not unfollow yourself"} =
               json_response_and_validate_schema(conn_res, 400)

      # remove non existing user
      conn_res = post(conn, "/api/v1/accounts/doesntexist/remove_from_followers")
      assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)
    end
  end
end