diff --git a/changelog.d/resolving-users-unauthenticated.fix b/changelog.d/resolving-users-unauthenticated.fix new file mode 100644 index 000000000..39598f0bf --- /dev/null +++ b/changelog.d/resolving-users-unauthenticated.fix @@ -0,0 +1 @@ +Account lookups for unauthenticated users was checking the :limit_to_local_content setting meant for restricting Search access diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex index 7a8a68931..3232c19fd 100644 --- a/lib/pleroma/user.ex +++ b/lib/pleroma/user.ex @@ -310,7 +310,7 @@ defmodule Pleroma.User do @spec visible_for(User.t(), User.t() | nil) :: :visible | :invisible - | :restricted_unauthenticated + | :restrict_unauthenticated | :deactivated | :confirmation_pending def visible_for(user, for_user \\ nil) @@ -1288,16 +1288,17 @@ defmodule Pleroma.User do end def get_cached_by_nickname_or_id(nickname_or_id, opts \\ []) do - restrict_to_local = Config.get([:instance, :limit_to_local_content]) + visibility = visible_for(opts[:for]) + restrict_remote_profiles = Config.restrict_unauthenticated_access?(:profiles, :remote) cond do is_integer(nickname_or_id) or FlakeId.flake_id?(nickname_or_id) -> get_cached_by_id(nickname_or_id) || get_cached_by_nickname(nickname_or_id) - restrict_to_local == false or not String.contains?(nickname_or_id, "@") -> + match?(:visible, visibility) -> get_cached_by_nickname(nickname_or_id) - restrict_to_local == :unauthenticated and match?(%User{}, opts[:for]) -> + match?(false, restrict_remote_profiles) or not String.contains?(nickname_or_id, "@") -> get_cached_by_nickname(nickname_or_id) true -> diff --git a/test/pleroma/user_test.exs b/test/pleroma/user_test.exs index 78018fedc..f7e1011f9 100644 --- a/test/pleroma/user_test.exs +++ b/test/pleroma/user_test.exs @@ -2529,48 +2529,58 @@ defmodule Pleroma.UserTest do [local_user: local_user, remote_user: remote_user] end - setup do: clear_config([:instance, :limit_to_local_content]) + setup do: clear_config([:restrict_unauthenticated]) + + test "allows getting remote users by id no matter what :restrict_unauthenticated is set to", + %{ + remote_user: remote_user + } do + clear_config([:restrict_unauthenticated], + profiles: %{local: false, remote: false} + ) - test "allows getting remote users by id no matter what :limit_to_local_content is set to", %{ - remote_user: remote_user - } do - clear_config([:instance, :limit_to_local_content], false) assert %User{} = User.get_cached_by_nickname_or_id(remote_user.id) - clear_config([:instance, :limit_to_local_content], true) - assert %User{} = User.get_cached_by_nickname_or_id(remote_user.id) - - clear_config([:instance, :limit_to_local_content], :unauthenticated) + clear_config([:restrict_unauthenticated], profiles: %{local: true, remote: true}) assert %User{} = User.get_cached_by_nickname_or_id(remote_user.id) end - test "disallows getting remote users by nickname without authentication when :limit_to_local_content is set to :unauthenticated", + test "disallows getting remote users by nickname without authentication when :restrict_unauthenticated", %{remote_user: remote_user} do - clear_config([:instance, :limit_to_local_content], :unauthenticated) + clear_config([:restrict_unauthenticated], + profiles: %{local: false, remote: true} + ) + assert nil == User.get_cached_by_nickname_or_id(remote_user.nickname) end - test "allows getting remote users by nickname with authentication when :limit_to_local_content is set to :unauthenticated", + test "allows getting remote users by nickname with authentication when :restrict_unauthenticated", %{remote_user: remote_user, local_user: local_user} do - clear_config([:instance, :limit_to_local_content], :unauthenticated) + clear_config([:restrict_unauthenticated], + profiles: %{local: false, remote: true} + ) + assert %User{} = User.get_cached_by_nickname_or_id(remote_user.nickname, for: local_user) end - test "disallows getting remote users by nickname when :limit_to_local_content is set to true", + test "disallows getting remote users by nickname when :restrict_unauthenticated", %{remote_user: remote_user} do - clear_config([:instance, :limit_to_local_content], true) + clear_config([:restrict_unauthenticated], + profiles: %{local: false, remote: true} + ) + assert nil == User.get_cached_by_nickname_or_id(remote_user.nickname) end - test "allows getting local users by nickname no matter what :limit_to_local_content is set to", + test "allows getting local users by nickname no matter what :restrict_unauthenticated is set to", %{local_user: local_user} do - clear_config([:instance, :limit_to_local_content], false) + clear_config([:restrict_unauthenticated], profiles: %{local: true, remote: true}) assert %User{} = User.get_cached_by_nickname_or_id(local_user.nickname) - clear_config([:instance, :limit_to_local_content], true) - assert %User{} = User.get_cached_by_nickname_or_id(local_user.nickname) + clear_config([:restrict_unauthenticated], + profiles: %{local: false, remote: false} + ) - clear_config([:instance, :limit_to_local_content], :unauthenticated) assert %User{} = User.get_cached_by_nickname_or_id(local_user.nickname) end end diff --git a/test/pleroma/web/admin_api/controllers/admin_api_controller_test.exs b/test/pleroma/web/admin_api/controllers/admin_api_controller_test.exs index a7ee8359d..1f69e9e62 100644 --- a/test/pleroma/web/admin_api/controllers/admin_api_controller_test.exs +++ b/test/pleroma/web/admin_api/controllers/admin_api_controller_test.exs @@ -789,15 +789,6 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIControllerTest do end end - test "gets a remote users when [:instance, :limit_to_local_content] is set to :unauthenticated", - %{conn: conn} do - clear_config(Pleroma.Config.get([:instance, :limit_to_local_content]), :unauthenticated) - user = insert(:user, %{local: false, nickname: "u@peer1.com"}) - conn = get(conn, "/api/pleroma/admin/users/#{user.nickname}/credentials") - - assert json_response(conn, 200) - end - describe "GET /users/:nickname/credentials" do test "gets the user credentials", %{conn: conn} do clear_config([:instance, :admin_privileges], [:users_manage_credentials]) diff --git a/test/pleroma/web/mastodon_api/controllers/account_controller_test.exs b/test/pleroma/web/mastodon_api/controllers/account_controller_test.exs index e87b33960..6c8b5d68a 100644 --- a/test/pleroma/web/mastodon_api/controllers/account_controller_test.exs +++ b/test/pleroma/web/mastodon_api/controllers/account_controller_test.exs @@ -87,7 +87,9 @@ defmodule Pleroma.Web.MastodonAPI.AccountControllerTest do end test "works by nickname for remote users" do - clear_config([:instance, :limit_to_local_content], false) + clear_config([:restrict_unauthenticated], + profiles: %{local: false, remote: false} + ) user = insert(:user, nickname: "user@example.com", local: false) @@ -97,8 +99,10 @@ defmodule Pleroma.Web.MastodonAPI.AccountControllerTest do |> json_response_and_validate_schema(200) end - test "respects limit_to_local_content == :all for remote user nicknames" do - clear_config([:instance, :limit_to_local_content], :all) + test "respects :restrict_unauthenticated for remote user nicknames" do + clear_config([:restrict_unauthenticated], + profiles: %{local: false, remote: true} + ) user = insert(:user, nickname: "user@example.com", local: false) @@ -107,28 +111,6 @@ defmodule Pleroma.Web.MastodonAPI.AccountControllerTest do |> json_response_and_validate_schema(404) end - test "respects limit_to_local_content == :unauthenticated for remote user nicknames" do - clear_config([:instance, :limit_to_local_content], :unauthenticated) - - user = insert(:user, nickname: "user@example.com", local: false) - reading_user = insert(:user) - - conn = - build_conn() - |> get("/api/v1/accounts/#{user.nickname}") - - assert json_response_and_validate_schema(conn, 404) - - conn = - build_conn() - |> assign(:user, reading_user) - |> assign(:token, insert(:oauth_token, user: reading_user, scopes: ["read:accounts"])) - |> get("/api/v1/accounts/#{user.nickname}") - - assert %{"id" => id} = json_response_and_validate_schema(conn, 200) - assert id == user.id - end - test "accounts fetches correct account for nicknames beginning with numbers", %{conn: conn} do # Need to set an old-style integer ID to reproduce the problem # (these are no longer assigned to new accounts but were preserved