defmodule Mobilizon.GraphQL.Resolvers.AdminTest do use Mobilizon.Web.ConnCase use Bamboo.Test import Mobilizon.Factory alias Mobilizon.Actors.Actor alias Mobilizon.Events.Event alias Mobilizon.Federation.ActivityPub.Relay alias Mobilizon.Reports.{Note, Report} alias Mobilizon.Users.User alias Mobilizon.Web.Email alias Mobilizon.GraphQL.{AbsintheHelpers, API} describe "Resolver: List the action logs" do @note_content "This a note on a report" test "list_action_logs/3 list action logs", %{conn: conn} do %User{} = user_moderator = insert(:user, role: :moderator) %Actor{} = moderator = insert(:actor, user: user_moderator) %User{} = user_moderator_2 = insert(:user, role: :moderator) %Actor{} = moderator_2 = insert(:actor, user: user_moderator_2) %Report{} = report = insert(:report) API.Reports.update_report_status(moderator, report, "resolved") {:ok, %Note{} = note} = API.Reports.create_report_note(report, moderator_2, @note_content) API.Reports.delete_report_note(note, moderator_2) query = """ { actionLogs { total elements { action, actor { preferredUsername }, object { ... on Report { id, status }, ... on ReportNote { content } } } } } """ res = conn |> get("/api", AbsintheHelpers.query_skeleton(query, "actionLogs")) assert json_response(res, 200)["errors"] |> hd |> Map.get("message") == "You need to be logged-in and a moderator to list action logs" res = conn |> auth_conn(user_moderator) |> get("/api", AbsintheHelpers.query_skeleton(query, "actionLogs")) assert json_response(res, 200)["errors"] == nil assert json_response(res, 200)["data"]["actionLogs"]["total"] == 3 assert json_response(res, 200)["data"]["actionLogs"]["elements"] |> length == 3 assert json_response(res, 200)["data"]["actionLogs"]["elements"] == [ %{ "action" => "NOTE_DELETION", "actor" => %{"preferredUsername" => moderator_2.preferred_username}, "object" => %{"content" => @note_content} }, %{ "action" => "NOTE_CREATION", "actor" => %{"preferredUsername" => moderator_2.preferred_username}, "object" => %{"content" => @note_content} }, %{ "action" => "REPORT_UPDATE_RESOLVED", "actor" => %{"preferredUsername" => moderator.preferred_username}, "object" => %{"id" => to_string(report.id), "status" => "RESOLVED"} } ] end end describe "Resolver: Get the dashboard statistics" do test "get_dashboard/3 gets dashboard information", %{conn: conn} do %Event{title: title} = insert(:event) %User{} = user_admin = insert(:user, role: :administrator) query = """ { dashboard { lastPublicEventPublished { title } numberOfUsers, numberOfComments, numberOfEvents, numberOfReports } } """ res = conn |> get("/api", AbsintheHelpers.query_skeleton(query, "actionLogs")) assert json_response(res, 200)["errors"] |> hd |> Map.get("message") == "You need to be logged-in and an administrator to access dashboard statistics" res = conn |> auth_conn(user_admin) |> get("/api", AbsintheHelpers.query_skeleton(query, "actionLogs")) assert json_response(res, 200)["errors"] == nil assert json_response(res, 200)["data"]["dashboard"]["lastPublicEventPublished"]["title"] == title end end describe "Resolver: Get the list of relay followers" do @relay_followers_query """ { relayFollowers { elements { actor { preferredUsername, domain, }, approved }, total } } """ @relay_followings_query """ { relayFollowings { elements { targetActor { preferredUsername, domain, }, approved }, total } } """ test "test list_relay_followers/3 returns nothing when not logged-in", %{conn: conn} do follower_actor = insert(:actor, domain: "localhost", user: nil, url: "http://localhost:8080/actor", preferred_username: "instance_actor", name: "I am an instance actor" ) %Actor{} = relay_actor = Relay.get_actor() insert(:follower, actor: follower_actor, target_actor: relay_actor) res = conn |> AbsintheHelpers.graphql_query(query: @relay_followers_query) assert hd(res["errors"])["message"] == "You need to be logged in" assert hd(res["errors"])["status_code"] == 401 end test "test list_relay_followers/3 returns nothing when not an admin", %{conn: conn} do %User{} = user_moderator = insert(:user, role: :moderator) %User{} = user = insert(:user) follower_actor = insert(:actor, domain: "localhost", user: nil, url: "http://localhost:8080/actor", preferred_username: "instance_actor", name: "I am an instance actor" ) %Actor{} = relay_actor = Relay.get_actor() insert(:follower, actor: follower_actor, target_actor: relay_actor) res = conn |> auth_conn(user_moderator) |> AbsintheHelpers.graphql_query(query: @relay_followers_query) assert hd(res["errors"])["message"] == "You don't have permission to do this" assert hd(res["errors"])["status_code"] == 403 res = conn |> auth_conn(user) |> AbsintheHelpers.graphql_query(query: @relay_followers_query) assert hd(res["errors"])["message"] == "You don't have permission to do this" assert hd(res["errors"])["status_code"] == 403 end test "test list_relay_followers/3 returns relay followers", %{conn: conn} do %User{} = user_admin = insert(:user, role: :administrator) follower_actor = insert(:actor, domain: "localhost", user: nil, url: "http://localhost:8080/actor", preferred_username: "instance_actor", name: "I am an instance actor" ) %Actor{} = relay_actor = Relay.get_actor() insert(:follower, actor: follower_actor, target_actor: relay_actor) res = conn |> auth_conn(user_admin) |> AbsintheHelpers.graphql_query(query: @relay_followers_query) assert is_nil(res["errors"]) assert hd(res["data"]["relayFollowers"]["elements"]) == %{ "actor" => %{"preferredUsername" => "instance_actor", "domain" => "localhost"}, "approved" => false } end test "test list_relay_followings/3 returns nothing when not logged-in", %{conn: conn} do %Actor{} = following_actor = insert(:actor, domain: "localhost", user: nil, url: "http://localhost:8080/actor", preferred_username: "instance_actor", name: "I am an instance actor" ) %Actor{} = relay_actor = Relay.get_actor() insert(:follower, actor: relay_actor, target_actor: following_actor) res = conn |> AbsintheHelpers.graphql_query(query: @relay_followings_query) assert hd(res["errors"])["message"] == "You need to be logged in" assert hd(res["errors"])["status_code"] == 401 end test "test list_relay_followings/3 returns nothing when not an admin", %{conn: conn} do %User{} = user_moderator = insert(:user, role: :moderator) %User{} = user = insert(:user) %Actor{} = following_actor = insert(:actor, domain: "localhost", user: nil, url: "http://localhost:8080/actor", preferred_username: "instance_actor", name: "I am an instance actor" ) %Actor{} = relay_actor = Relay.get_actor() insert(:follower, actor: relay_actor, target_actor: following_actor) res = conn |> auth_conn(user_moderator) |> AbsintheHelpers.graphql_query(query: @relay_followings_query) assert hd(res["errors"])["message"] == "You don't have permission to do this" assert hd(res["errors"])["status_code"] == 403 res = conn |> auth_conn(user) |> AbsintheHelpers.graphql_query(query: @relay_followings_query) assert hd(res["errors"])["message"] == "You don't have permission to do this" assert hd(res["errors"])["status_code"] == 403 end test "test list_relay_followings/3 returns relay followings", %{conn: conn} do %User{} = user_admin = insert(:user, role: :administrator) %Actor{ preferred_username: following_actor_preferred_username, domain: following_actor_domain } = following_actor = insert(:actor, domain: "localhost", user: nil, url: "http://localhost:8080/actor", preferred_username: "instance_actor", name: "I am an instance actor" ) %Actor{} = relay_actor = Relay.get_actor() insert(:follower, actor: relay_actor, target_actor: following_actor) res = conn |> auth_conn(user_admin) |> AbsintheHelpers.graphql_query(query: @relay_followings_query) assert is_nil(res["errors"]) assert hd(res["data"]["relayFollowings"]["elements"]) == %{ "targetActor" => %{ "preferredUsername" => following_actor_preferred_username, "domain" => following_actor_domain }, "approved" => false } end end @admin_settings_fragment """ fragment adminSettingsFragment on AdminSettings { instanceName instanceDescription instanceLongDescription contact instanceTerms instanceTermsType instanceTermsUrl instancePrivacyPolicy instancePrivacyPolicyType instancePrivacyPolicyUrl instanceRules registrationsOpen } """ describe "Resolver: Get the instance admin settings" do @admin_settings_query """ query { adminSettings { ...adminSettingsFragment } } #{@admin_settings_fragment} """ setup %{conn: conn} do Cachex.clear(:config) [conn: conn] end test "from config files", %{conn: conn} do admin = insert(:user, role: :administrator) res = conn |> auth_conn(admin) |> AbsintheHelpers.graphql_query(query: @admin_settings_query) assert res["data"]["adminSettings"]["instanceName"] == Application.get_env(:mobilizon, :instance)[:name] assert res["data"]["adminSettings"]["registrationsOpen"] == Application.get_env(:mobilizon, :instance)[:registrations_open] end @instance_name "My Awesome Instance" test "from DB", %{conn: conn} do admin = insert(:user, role: :administrator) insert(:admin_setting, group: "instance", name: "instance_name", value: @instance_name) insert(:admin_setting, group: "instance", name: "registrations_open", value: "false") res = conn |> auth_conn(admin) |> AbsintheHelpers.graphql_query(query: @admin_settings_query) assert res["data"]["adminSettings"]["instanceName"] == @instance_name assert res["data"]["adminSettings"]["registrationsOpen"] == false end test "unless user isn't admin", %{conn: conn} do admin = insert(:user) res = conn |> auth_conn(admin) |> AbsintheHelpers.graphql_query(query: @admin_settings_query) assert hd(res["errors"])["message"] == "You need to be logged-in and an administrator to access admin settings" end end describe "Resolver: Update the instance admin settings" do setup %{conn: conn} do Cachex.clear(:config) [conn: conn] end @update_instance_admin_settings_mutation """ mutation SaveAdminSettings( $instanceName: String $instanceDescription: String $instanceLongDescription: String $contact: String $instanceTerms: String $instanceTermsType: InstanceTermsType $instanceTermsUrl: String $instancePrivacyPolicy: String $instancePrivacyPolicyType: InstancePrivacyType $instancePrivacyPolicyUrl: String $instanceRules: String $registrationsOpen: Boolean ) { saveAdminSettings( instanceName: $instanceName instanceDescription: $instanceDescription instanceLongDescription: $instanceLongDescription contact: $contact instanceTerms: $instanceTerms instanceTermsType: $instanceTermsType instanceTermsUrl: $instanceTermsUrl instancePrivacyPolicy: $instancePrivacyPolicy instancePrivacyPolicyType: $instancePrivacyPolicyType instancePrivacyPolicyUrl: $instancePrivacyPolicyUrl instanceRules: $instanceRules registrationsOpen: $registrationsOpen ) { ...adminSettingsFragment } } #{@admin_settings_fragment} """ @new_instance_name "new Instance Name" test "does the setting update and updates instance actor as well", %{conn: conn} do admin = insert(:user, role: :administrator) res = conn |> auth_conn(admin) |> AbsintheHelpers.graphql_query(query: @admin_settings_query) assert res["data"]["adminSettings"]["instanceName"] == Application.get_env(:mobilizon, :instance)[:name] assert res["data"]["adminSettings"]["registrationsOpen"] == Application.get_env(:mobilizon, :instance)[:registrations_open] res = conn |> auth_conn(admin) |> AbsintheHelpers.graphql_query( query: @update_instance_admin_settings_mutation, variables: %{"instanceName" => @new_instance_name, "registrationsOpen" => false} ) assert res["data"]["saveAdminSettings"]["instanceName"] == @new_instance_name assert res["data"]["saveAdminSettings"]["registrationsOpen"] == false assert %Actor{name: @new_instance_name} = Relay.get_actor() end test "unless user isn't admin", %{conn: conn} do user = insert(:user) res = conn |> auth_conn(user) |> AbsintheHelpers.graphql_query( query: @update_instance_admin_settings_mutation, variables: %{"instanceName" => @new_instance_name, "registrationsOpen" => false} ) assert hd(res["errors"])["message"] == "You need to be logged-in and an administrator to save admin settings" end end @admin_update_user """ mutation AdminUpdateUser($id: ID!, $email: String, $role: UserRole, $confirmed: Boolean, $notify: Boolean) { adminUpdateUser(id: $id, email: $email, role: $role, confirmed: $confirmed, notify: $notify) { id email role confirmedAt } } """ describe "Resolver: Update an user email" do setup do admin = insert(:user, role: :administrator) user = insert(:user) {:ok, admin: admin, user: user} end test "when not an admin", %{conn: conn, user: user} do admin = insert(:user) res = conn |> auth_conn(admin) |> AbsintheHelpers.graphql_query( query: @admin_update_user, variables: %{"id" => user.id, "email" => "new@email.com"} ) assert hd(res["errors"])["message"] == "You need to be logged-in and an administrator to edit an user's details" end test "when putting same email", %{conn: conn, user: user, admin: admin} do res = conn |> auth_conn(admin) |> AbsintheHelpers.graphql_query( query: @admin_update_user, variables: %{"id" => user.id, "email" => user.email} ) assert hd(res["errors"])["message"] == "The new email must be different" end test "with an invalid email", %{conn: conn, user: user, admin: admin} do res = conn |> auth_conn(admin) |> AbsintheHelpers.graphql_query( query: @admin_update_user, variables: %{"id" => user.id, "email" => "not an email"} ) assert hd(res["errors"])["message"] == "The new email doesn't seem to be valid" end test "with a valid email, and no notification", %{conn: conn, user: user, admin: admin} do res = conn |> auth_conn(admin) |> AbsintheHelpers.graphql_query( query: @admin_update_user, variables: %{"id" => user.id, "email" => "new@email.com", "notify" => false} ) refute_delivered_email( Email.Admin.user_email_change_old(%User{user | email: "new@email.com"}, user.email) ) refute_delivered_email( Email.Admin.user_email_change_new(%User{user | email: "new@email.com"}, user.email) ) assert res["errors"] == nil assert res["data"]["adminUpdateUser"]["email"] == "new@email.com" end test "with a valid email, and notification", %{conn: conn, user: user, admin: admin} do res = conn |> auth_conn(admin) |> AbsintheHelpers.graphql_query( query: @admin_update_user, variables: %{"id" => user.id, "email" => "new@email.com", "notify" => true} ) assert_delivered_email( Email.Admin.user_email_change_old(%User{user | email: "new@email.com"}, user.email) ) assert_delivered_email( Email.Admin.user_email_change_new(%User{user | email: "new@email.com"}, user.email) ) assert res["errors"] == nil assert res["data"]["adminUpdateUser"]["email"] == "new@email.com" end end describe "Resolver: Update an user role" do setup do admin = insert(:user, role: :administrator) user = insert(:user) {:ok, admin: admin, user: user} end test "when putting same role", %{conn: conn, user: user, admin: admin} do res = conn |> auth_conn(admin) |> AbsintheHelpers.graphql_query( query: @admin_update_user, variables: %{"id" => user.id, "role" => String.upcase(to_string(user.role))} ) assert hd(res["errors"])["message"] == "The new role must be different" end test "with an invalid role", %{conn: conn, user: user, admin: admin} do res = conn |> auth_conn(admin) |> AbsintheHelpers.graphql_query( query: @admin_update_user, variables: %{"id" => user.id, "role" => "not a valid role"} ) assert hd(res["errors"])["message"] == "Argument \"role\" has invalid value $role." end test "with a valid role, and no notification", %{conn: conn, user: user, admin: admin} do res = conn |> auth_conn(admin) |> AbsintheHelpers.graphql_query( query: @admin_update_user, variables: %{"id" => user.id, "role" => "MODERATOR", "notify" => false} ) refute_delivered_email( Email.Admin.user_role_change(%User{user | role: :moderator}, user.role) ) assert res["errors"] == nil assert res["data"]["adminUpdateUser"]["role"] == "MODERATOR" end test "with a valid role, and notification", %{conn: conn, user: user, admin: admin} do res = conn |> auth_conn(admin) |> AbsintheHelpers.graphql_query( query: @admin_update_user, variables: %{"id" => user.id, "role" => "MODERATOR", "notify" => true} ) assert_delivered_email( Email.Admin.user_role_change(%User{user | role: :moderator}, user.role) ) assert res["errors"] == nil assert res["data"]["adminUpdateUser"]["role"] == "MODERATOR" end end describe "Resolver: Confirm an user" do setup do admin = insert(:user, role: :administrator) user = insert(:user) {:ok, admin: admin, user: user} end test "already confirmed", %{conn: conn, user: user, admin: admin} do res = conn |> auth_conn(admin) |> AbsintheHelpers.graphql_query( query: @admin_update_user, variables: %{"id" => user.id, "confirmed" => true, "notify" => false} ) refute_delivered_email(Email.Admin.user_confirmation(user)) assert hd(res["errors"])["message"] == "Can't confirm an already confirmed user" end test "while unconfirming", %{conn: conn, user: user, admin: admin} do res = conn |> auth_conn(admin) |> AbsintheHelpers.graphql_query( query: @admin_update_user, variables: %{"id" => user.id, "confirmed" => false, "notify" => false} ) refute_delivered_email(Email.Admin.user_confirmation(user)) assert hd(res["errors"])["message"] == "Deconfirming users is not supported" end test "while confirming, and no notification", %{conn: conn, admin: admin} do user = insert(:user, confirmed_at: nil) res = conn |> auth_conn(admin) |> AbsintheHelpers.graphql_query( query: @admin_update_user, variables: %{"id" => user.id, "confirmed" => true, "notify" => false} ) refute_delivered_email(Email.Admin.user_confirmation(user)) assert res["errors"] == nil refute res["data"]["adminUpdateUser"]["confirmedAt"] == nil end test "while confirming, and notification", %{conn: conn, admin: admin} do user = insert(:user, confirmed_at: nil) res = conn |> auth_conn(admin) |> AbsintheHelpers.graphql_query( query: @admin_update_user, variables: %{"id" => user.id, "confirmed" => true, "notify" => true} ) assert_delivered_email(Email.Admin.user_confirmation(user)) assert res["errors"] == nil refute res["data"]["adminUpdateUser"]["confirmedAt"] == nil end end end