From 50948b46aabc0756d85bc6641f0bd3bcc09bf7d4 Mon Sep 17 00:00:00 2001 From: Eugen Rochko Date: Tue, 20 Sep 2022 23:51:21 +0200 Subject: Add ability to filter followed accounts' posts by language (#19095) --- spec/controllers/api/v1/accounts_controller_spec.rb | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'spec/controllers/api') diff --git a/spec/controllers/api/v1/accounts_controller_spec.rb b/spec/controllers/api/v1/accounts_controller_spec.rb index 5d5c245c5..d6bbcefd7 100644 --- a/spec/controllers/api/v1/accounts_controller_spec.rb +++ b/spec/controllers/api/v1/accounts_controller_spec.rb @@ -145,6 +145,17 @@ RSpec.describe Api::V1::AccountsController, type: :controller do expect(json[:showing_reblogs]).to be false expect(json[:notifying]).to be true end + + it 'changes languages option' do + post :follow, params: { id: other_account.id, languages: %w(en es) } + + json = body_as_json + + expect(json[:following]).to be true + expect(json[:showing_reblogs]).to be false + expect(json[:notifying]).to be false + expect(json[:languages]).to match_array %w(en es) + end end end -- cgit From 1ae508bf2faae016b88d15e273b0dc01de4fd7af Mon Sep 17 00:00:00 2001 From: Eugen Rochko Date: Wed, 26 Oct 2022 12:10:02 +0200 Subject: Change unauthenticated search to not support pagination in REST API (#19326) - Only exact search matches for queries with < 5 characters - Do not support queries with `offset` (pagination) - Return HTTP 401 on truthy `resolve` instead of overriding to false --- app/controllers/api/v2/search_controller.rb | 13 ++++- app/services/account_search_service.rb | 5 ++ spec/controllers/api/v2/search_controller_spec.rb | 62 ++++++++++++++++++++--- 3 files changed, 71 insertions(+), 9 deletions(-) (limited to 'spec/controllers/api') diff --git a/app/controllers/api/v2/search_controller.rb b/app/controllers/api/v2/search_controller.rb index e384ecbaf..4d20aeb10 100644 --- a/app/controllers/api/v2/search_controller.rb +++ b/app/controllers/api/v2/search_controller.rb @@ -6,6 +6,7 @@ class Api::V2::SearchController < Api::BaseController RESULTS_LIMIT = 20 before_action -> { authorize_if_got_token! :read, :'read:search' } + before_action :validate_search_params! def index @search = Search.new(search_results) @@ -18,12 +19,22 @@ class Api::V2::SearchController < Api::BaseController private + def validate_search_params! + params.require(:q) + + return if user_signed_in? + + return render json: { error: 'Search queries pagination is not supported without authentication' }, status: 401 if params[:offset].present? + + render json: { error: 'Search queries that resolve remote resources are not supported without authentication' }, status: 401 if truthy_param?(:resolve) + end + def search_results SearchService.new.call( params[:q], current_account, limit_param(RESULTS_LIMIT), - search_params.merge(resolve: user_signed_in? ? truthy_param?(:resolve) : false, exclude_unreviewed: truthy_param?(:exclude_unreviewed)) + search_params.merge(resolve: truthy_param?(:resolve), exclude_unreviewed: truthy_param?(:exclude_unreviewed)) ) end diff --git a/app/services/account_search_service.rb b/app/services/account_search_service.rb index 4dcae20eb..35b2e05f5 100644 --- a/app/services/account_search_service.rb +++ b/app/services/account_search_service.rb @@ -3,6 +3,9 @@ class AccountSearchService < BaseService attr_reader :query, :limit, :offset, :options, :account + # Min. number of characters to look for non-exact matches + MIN_QUERY_LENGTH = 5 + def call(query, account = nil, options = {}) @acct_hint = query&.start_with?('@') @query = query&.strip&.gsub(/\A@/, '') @@ -135,6 +138,8 @@ class AccountSearchService < BaseService end def limit_for_non_exact_results + return 0 if @account.nil? && query.size < MIN_QUERY_LENGTH + if exact_match? limit - 1 else diff --git a/spec/controllers/api/v2/search_controller_spec.rb b/spec/controllers/api/v2/search_controller_spec.rb index fa20e1e51..d417ea58c 100644 --- a/spec/controllers/api/v2/search_controller_spec.rb +++ b/spec/controllers/api/v2/search_controller_spec.rb @@ -5,18 +5,64 @@ require 'rails_helper' RSpec.describe Api::V2::SearchController, type: :controller do render_views - let(:user) { Fabricate(:user) } - let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read:search') } + context 'with token' do + let(:user) { Fabricate(:user) } + let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read:search') } - before do - allow(controller).to receive(:doorkeeper_token) { token } + before do + allow(controller).to receive(:doorkeeper_token) { token } + end + + describe 'GET #index' do + before do + get :index, params: { q: 'test' } + end + + it 'returns http success' do + expect(response).to have_http_status(200) + end + end end - describe 'GET #index' do - it 'returns http success' do - get :index, params: { q: 'test' } + context 'without token' do + describe 'GET #index' do + let(:search_params) {} + + before do + get :index, params: search_params + end + + context 'with a `q` shorter than 5 characters' do + let(:search_params) { { q: 'test' } } + + it 'returns http success' do + expect(response).to have_http_status(200) + end + end + + context 'with a `q` equal to or longer than 5 characters' do + let(:search_params) { { q: 'test1' } } + + it 'returns http success' do + expect(response).to have_http_status(200) + end + + context 'with truthy `resolve`' do + let(:search_params) { { q: 'test1', resolve: '1' } } + + it 'returns http unauthorized' do + expect(response).to have_http_status(401) + end + end + + context 'with `offset`' do + let(:search_params) { { q: 'test1', offset: 1 } } - expect(response).to have_http_status(200) + it 'returns http unauthorized' do + expect(response).to have_http_status(401) + end + end + end end end end -- cgit From 40c7f3e830538951862dc73074d1045a82395ab0 Mon Sep 17 00:00:00 2001 From: Eugen Rochko Date: Sun, 30 Oct 2022 02:44:32 +0200 Subject: Fix account action type validation (#19476) * Fix account action type validation Fix #19143 * Fix #19145 * Fix code style issues --- app/models/admin/account_action.rb | 9 +++-- .../v1/admin/account_actions_controller_spec.rb | 44 ++++++++++++++-------- 2 files changed, 34 insertions(+), 19 deletions(-) (limited to 'spec/controllers/api') diff --git a/app/models/admin/account_action.rb b/app/models/admin/account_action.rb index aed3bc0c7..bce0d6e17 100644 --- a/app/models/admin/account_action.rb +++ b/app/models/admin/account_action.rb @@ -25,6 +25,8 @@ class Admin::AccountAction alias send_email_notification? send_email_notification alias include_statuses? include_statuses + validates :type, :target_account, :current_account, presence: true + def initialize(attributes = {}) @send_email_notification = true @include_statuses = true @@ -41,13 +43,15 @@ class Admin::AccountAction end def save! + raise ActiveRecord::RecordInvalid, self unless valid? + ApplicationRecord.transaction do process_action! process_strike! + process_reports! end process_email! - process_reports! process_queue! end @@ -106,9 +110,8 @@ class Admin::AccountAction # Otherwise, we will mark all unresolved reports about # the account as resolved. - reports.each { |report| authorize(report, :update?) } - reports.each do |report| + authorize(report, :update?) log_action(:resolve, report) report.resolve!(current_account) end diff --git a/spec/controllers/api/v1/admin/account_actions_controller_spec.rb b/spec/controllers/api/v1/admin/account_actions_controller_spec.rb index 199395f55..462c2cfa9 100644 --- a/spec/controllers/api/v1/admin/account_actions_controller_spec.rb +++ b/spec/controllers/api/v1/admin/account_actions_controller_spec.rb @@ -30,28 +30,40 @@ RSpec.describe Api::V1::Admin::AccountActionsController, type: :controller do end describe 'POST #create' do - before do - post :create, params: { account_id: account.id, type: 'disable' } - end + context do + before do + post :create, params: { account_id: account.id, type: 'disable' } + end - it_behaves_like 'forbidden for wrong scope', 'write:statuses' - it_behaves_like 'forbidden for wrong role', '' + it_behaves_like 'forbidden for wrong scope', 'write:statuses' + it_behaves_like 'forbidden for wrong role', '' - it 'returns http success' do - expect(response).to have_http_status(200) - end + it 'returns http success' do + expect(response).to have_http_status(200) + end + + it 'performs action against account' do + expect(account.reload.user_disabled?).to be true + end + + it 'logs action' do + log_item = Admin::ActionLog.last - it 'performs action against account' do - expect(account.reload.user_disabled?).to be true + expect(log_item).to_not be_nil + expect(log_item.action).to eq :disable + expect(log_item.account_id).to eq user.account_id + expect(log_item.target_id).to eq account.user.id + end end - it 'logs action' do - log_item = Admin::ActionLog.last + context 'with no type' do + before do + post :create, params: { account_id: account.id } + end - expect(log_item).to_not be_nil - expect(log_item.action).to eq :disable - expect(log_item.account_id).to eq user.account_id - expect(log_item.target_id).to eq account.user.id + it 'returns http unprocessable entity' do + expect(response).to have_http_status(422) + end end end end -- cgit