Merge branch 'main' into glitch-soc/merge-upstream

Conflicts:
- `.prettierignore`:
  Upstream added a line at the end, glitch-soc had extra entries at the end.
  Added upstream's new line before glitch-soc's.
- `Gemfile.lock`:
  Upstream updated dependencies while glitch-soc has an extra one (hcaptcha).
  Updated dependencies like upstream did.
- `app/controllers/api/v1/statuses_controller.rb`:
  Not a real conflict, upstream added a parameter (`allowed_mentions`) where
  glitch-soc already had an extra one (`content_type`).
  Added upstream's new parameter.
- `app/javascript/styles/fonts/roboto-mono.scss`:
  A lot of lines were changed upstream due to code style changes, and a lot
  of those lines had path changes to accomodate glitch-soc's theming system.
  Applied upstream's style changes.
- `app/javascript/styles/fonts/roboto.scss`:
  A lot of lines were changed upstream due to code style changes, and a lot
  of those lines had path changes to accomodate glitch-soc's theming system.
  Applied upstream's style changes.

5 files changed, 115 insertions, 10 deletions

diff --git a/spec/controllers/api/v1/accounts/statuses_controller_spec.rb b/spec/controllers/api/v1/accounts/statuses_controller_spec.rb
index b962b3398..01d745fc0 100644
--- a/spec/controllers/api/v1/accounts/statuses_controller_spec.rb
+++ b/spec/controllers/api/v1/accounts/statuses_controller_spec.rb
@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'rails_helper'
 
 describe Api::V1::Accounts::StatusesController do
@@ -15,7 +16,12 @@ describe Api::V1::Accounts::StatusesController do
     it 'returns http success' do
       get :index, params: { account_id: user.account.id, limit: 1 }
 
-      expect(response).to have_http_status(200)
+      expect(response).to have_http_status(:ok)
+    end
+
+    it 'returns expected headers' do
+      get :index, params: { account_id: user.account.id, limit: 1 }
+
       expect(response.headers['Link'].links.size).to eq(2)
     end
 
@@ -23,19 +29,29 @@ describe Api::V1::Accounts::StatusesController do
       it 'returns http success' do
         get :index, params: { account_id: user.account.id, only_media: true }
 
-        expect(response).to have_http_status(200)
+        expect(response).to have_http_status(:ok)
       end
     end
 
     context 'with exclude replies' do
+      let!(:older_statuses) { user.account.statuses.destroy_all }
+      let!(:status) { Fabricate(:status, account: user.account) }
+      let!(:status_self_reply) { Fabricate(:status, account: user.account, thread: status) }
+
       before do
-        Fabricate(:status, account: user.account, thread: Fabricate(:status))
+        Fabricate(:status, account: user.account, thread: Fabricate(:status)) # Reply to another user
+        get :index, params: { account_id: user.account.id, exclude_replies: true }
       end
 
       it 'returns http success' do
-        get :index, params: { account_id: user.account.id, exclude_replies: true }
+        expect(response).to have_http_status(:ok)
+      end
+
+      it 'returns posts along with self replies' do
+        json = body_as_json
+        post_ids = json.map { |item| item[:id].to_i }.sort
 
-        expect(response).to have_http_status(200)
+        expect(post_ids).to eq [status.id, status_self_reply.id]
       end
     end
 
@@ -47,7 +63,7 @@ describe Api::V1::Accounts::StatusesController do
       it 'returns http success' do
         get :index, params: { account_id: user.account.id, pinned: true }
 
-        expect(response).to have_http_status(200)
+        expect(response).to have_http_status(:ok)
       end
     end
 
@@ -55,12 +71,15 @@ describe Api::V1::Accounts::StatusesController do
       let(:account)        { Fabricate(:account, username: 'bob', domain: 'example.com') }
       let(:status)         { Fabricate(:status, account: account) }
       let(:private_status) { Fabricate(:status, account: account, visibility: :private) }
-      let!(:pin)           { Fabricate(:status_pin, account: account, status: status) }
-      let!(:private_pin)   { Fabricate(:status_pin, account: account, status: private_status) }
+
+      before do
+        Fabricate(:status_pin, account: account, status: status)
+        Fabricate(:status_pin, account: account, status: private_status)
+      end
 
       it 'returns http success' do
         get :index, params: { account_id: account.id, pinned: true }
-        expect(response).to have_http_status(200)
+        expect(response).to have_http_status(:ok)
       end
 
       context 'when user does not follow account' do
diff --git a/spec/controllers/api/v1/statuses_controller_spec.rb b/spec/controllers/api/v1/statuses_controller_spec.rb
index 24810a5d2..bd8b8013a 100644
--- a/spec/controllers/api/v1/statuses_controller_spec.rb
+++ b/spec/controllers/api/v1/statuses_controller_spec.rb
@@ -133,6 +133,23 @@ RSpec.describe Api::V1::StatusesController, type: :controller do
         end
       end
 
+      context 'with a safeguard' do
+        let!(:alice) { Fabricate(:account, username: 'alice') }
+        let!(:bob)   { Fabricate(:account, username: 'bob') }
+
+        before do
+          post :create, params: { status: '@alice hm, @bob is really annoying lately', allowed_mentions: [alice.id] }
+        end
+
+        it 'returns http unprocessable entity' do
+          expect(response).to have_http_status(422)
+        end
+
+        it 'returns serialized extra accounts in body' do
+          expect(body_as_json[:unexpected_accounts].map { |a| a.slice(:id, :acct) }).to eq [{ id: bob.id.to_s, acct: bob.acct }]
+        end
+      end
+
       context 'with missing parameters' do
         before do
           post :create, params: {}
diff --git a/spec/serializers/rest/account_serializer_spec.rb b/spec/serializers/rest/account_serializer_spec.rb
new file mode 100644
index 000000000..ce29df3a7
--- /dev/null
+++ b/spec/serializers/rest/account_serializer_spec.rb
@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe REST::AccountSerializer do
+  let(:role)    { Fabricate(:user_role, name: 'Role', highlighted: true) }
+  let(:user)    { Fabricate(:user, role: role) }
+  let(:account) { user.account}
+
+  subject { JSON.parse(ActiveModelSerializers::SerializableResource.new(account, serializer: REST::AccountSerializer).to_json) }
+
+  context 'when the account is suspended' do
+    before do
+      account.suspend!
+    end
+
+    it 'returns empty roles' do
+      expect(subject['roles']).to eq []
+    end
+  end
+
+  context 'when the account has a highlighted role' do
+    let(:role) { Fabricate(:user_role, name: 'Role', highlighted: true) }
+
+    it 'returns the expected role' do
+      expect(subject['roles'].first).to include({ 'name' => 'Role' })
+    end
+  end
+
+  context 'when the account has a non-highlighted role' do
+    let(:role) { Fabricate(:user_role, name: 'Role', highlighted: false) }
+
+    it 'returns empty roles' do
+      expect(subject['roles']).to eq []
+    end
+  end
+end
diff --git a/spec/services/post_status_service_spec.rb b/spec/services/post_status_service_spec.rb
index d21270c79..28f20e9c7 100644
--- a/spec/services/post_status_service_spec.rb
+++ b/spec/services/post_status_service_spec.rb
@@ -138,7 +138,26 @@ RSpec.describe PostStatusService, type: :service do
     status = subject.call(account, text: "test status update")
 
     expect(ProcessMentionsService).to have_received(:new)
-    expect(mention_service).to have_received(:call).with(status)
+    expect(mention_service).to have_received(:call).with(status, save_records: false)
+  end
+
+  it 'safeguards mentions' do
+    account = Fabricate(:account)
+    mentioned_account = Fabricate(:account, username: 'alice')
+    unexpected_mentioned_account = Fabricate(:account, username: 'bob')
+
+    expect do
+      subject.call(account, text: '@alice hm, @bob is really annoying lately', allowed_mentions: [mentioned_account.id])
+    end.to raise_error(an_instance_of(PostStatusService::UnexpectedMentionsError).and having_attributes(accounts: [unexpected_mentioned_account]))
+  end
+
+  it 'processes duplicate mentions correctly' do
+    account = Fabricate(:account)
+    mentioned_account = Fabricate(:account, username: 'alice')
+
+    expect do
+      subject.call(account, text: '@alice @alice @alice hey @alice')
+    end.not_to raise_error
   end
 
   it 'processes hashtags' do
diff --git a/spec/services/process_mentions_service_spec.rb b/spec/services/process_mentions_service_spec.rb
index 5b9d17a4c..0dd62c807 100644
--- a/spec/services/process_mentions_service_spec.rb
+++ b/spec/services/process_mentions_service_spec.rb
@@ -47,6 +47,19 @@ RSpec.describe ProcessMentionsService, type: :service do
         end
       end
 
+      context 'mentioning a user several times when not saving records' do
+        let!(:remote_user) { Fabricate(:account, username: 'remote_user', protocol: :activitypub, domain: 'example.com', inbox_url: 'http://example.com/inbox') }
+        let(:status)       { Fabricate(:status, account: account, text: "Hello @#{remote_user.acct} @#{remote_user.acct} @#{remote_user.acct}", visibility: :public) }
+
+        before do
+          subject.call(status, save_records: false)
+        end
+
+        it 'creates exactly one mention' do
+          expect(status.mentions.size).to eq 1
+        end
+      end
+
       context 'with an IDN domain' do
         let!(:remote_user) { Fabricate(:account, username: 'sneak', protocol: :activitypub, domain: 'xn--hresiar-mxa.ch', inbox_url: 'http://example.com/inbox') }
         let!(:status) { Fabricate(:status, account: account, text: "Hello @sneak@hæresiar.ch") }