Compare commits

...

7 Commits

Author SHA1 Message Date
Eugen Rochko
7da3f24d0c
Merge 57de04ea46 into 4b8e60682d 2025-07-15 07:07:26 +00:00
renovate[bot]
4b8e60682d
fix(deps): update dependency react-select to v5.10.2 (#35352)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-07-15 06:32:38 +00:00
renovate[bot]
6c2db9b1cf
fix(deps): update dependency vite-plugin-static-copy to v3.1.1 (#35367)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-07-15 06:32:00 +00:00
Matt Jankowski
30344d6abf
Confirm User#login_activities in auth/sessions spec (#35372) 2025-07-15 06:31:00 +00:00
Matt Jankowski
1637297085
Add coverage for CustomFilterStatus model (#35374) 2025-07-15 06:28:40 +00:00
Matt Jankowski
dec1fb71f4
Add coverage for FollowRecommendationMute model (#35376) 2025-07-15 06:27:36 +00:00
Eugen Rochko
57de04ea46 Add automatic loading of new replies in web UI 2025-06-29 21:02:17 +02:00
22 changed files with 301 additions and 50 deletions

View File

@ -2,6 +2,7 @@
class Api::V1::StatusesController < Api::BaseController
include Authorization
include AsyncRefreshesConcern
before_action -> { authorize_if_got_token! :read, :'read:statuses' }, except: [:create, :update, :destroy]
before_action -> { doorkeeper_authorize! :write, :'write:statuses' }, only: [:create, :update, :destroy]
@ -57,9 +58,17 @@ class Api::V1::StatusesController < Api::BaseController
@context = Context.new(ancestors: loaded_ancestors, descendants: loaded_descendants)
statuses = [@status] + @context.ancestors + @context.descendants
render json: @context, serializer: REST::ContextSerializer, relationships: StatusRelationshipsPresenter.new(statuses, current_user&.account_id)
refresh_key = "context:#{@status.id}:refresh"
async_refresh = AsyncRefresh.new(refresh_key)
ActivityPub::FetchAllRepliesWorker.perform_async(@status.id) if !current_account.nil? && @status.should_fetch_replies?
if async_refresh.running?
add_async_refresh_header(async_refresh, retry_seconds: 10)
elsif !current_account.nil? && @status.should_fetch_replies?
add_async_refresh_header(AsyncRefresh.create(refresh_key), retry_seconds: 10)
ActivityPub::FetchAllRepliesWorker.perform_async(@status.id)
end
render json: @context, serializer: REST::ContextSerializer, relationships: StatusRelationshipsPresenter.new(statuses, current_user&.account_id)
end
def create

View File

@ -38,8 +38,7 @@ class Auth::OmniauthCallbacksController < Devise::OmniauthCallbacksController
private
def record_login_activity
LoginActivity.create(
user: @user,
@user.login_activities.create(
success: true,
authentication_method: :omniauth,
provider: @provider,

View File

@ -151,12 +151,11 @@ class Auth::SessionsController < Devise::SessionsController
sign_in(user)
flash.delete(:notice)
LoginActivity.create(
user: user,
success: true,
authentication_method: security_measure,
ip: request.remote_ip,
user_agent: request.user_agent
user.login_activities.create(
request_details.merge(
authentication_method: security_measure,
success: true
)
)
UserMailer.suspicious_sign_in(user, request.remote_ip, request.user_agent, Time.now.utc).deliver_later! if @login_is_suspicious
@ -167,13 +166,12 @@ class Auth::SessionsController < Devise::SessionsController
end
def on_authentication_failure(user, security_measure, failure_reason)
LoginActivity.create(
user: user,
success: false,
authentication_method: security_measure,
failure_reason: failure_reason,
ip: request.remote_ip,
user_agent: request.user_agent
user.login_activities.create(
request_details.merge(
authentication_method: security_measure,
failure_reason: failure_reason,
success: false
)
)
# Only send a notification email every hour at most
@ -182,6 +180,13 @@ class Auth::SessionsController < Devise::SessionsController
UserMailer.failed_2fa(user, request.remote_ip, request.user_agent, Time.now.utc).deliver_later!
end
def request_details
{
ip: request.remote_ip,
user_agent: request.user_agent,
}
end
def second_factor_attempts_key(user)
"2fa_auth_attempts:#{user.id}:#{Time.now.utc.hour}"
end

View File

@ -5,6 +5,6 @@ class Settings::LoginActivitiesController < Settings::BaseController
skip_before_action :require_functional!
def index
@login_activities = LoginActivity.where(user: current_user).order(id: :desc).page(params[:page])
@login_activities = current_user.login_activities.order(id: :desc).page(params[:page])
end
end

View File

@ -1,3 +1,5 @@
import { createAction } from '@reduxjs/toolkit';
import { apiGetContext } from 'mastodon/api/statuses';
import { createDataLoadingThunk } from 'mastodon/store/typed_functions';
@ -6,13 +8,18 @@ import { importFetchedStatuses } from './importer';
export const fetchContext = createDataLoadingThunk(
'status/context',
({ statusId }: { statusId: string }) => apiGetContext(statusId),
(context, { dispatch }) => {
({ context, refresh }, { dispatch }) => {
const statuses = context.ancestors.concat(context.descendants);
dispatch(importFetchedStatuses(statuses));
return {
context,
refresh,
};
},
);
export const completeContextRefresh = createAction<{ statusId: string }>(
'status/context/complete',
);

View File

@ -20,6 +20,50 @@ export const getLinks = (response: AxiosResponse) => {
return LinkHeader.parse(value);
};
export interface AsyncRefreshHeader {
id: string;
retry: number;
}
const isAsyncRefreshHeader = (obj: object): obj is AsyncRefreshHeader =>
'id' in obj && 'retry' in obj;
export const getAsyncRefreshHeader = (
response: AxiosResponse,
): AsyncRefreshHeader | null => {
const value = response.headers['mastodon-async-refresh'] as
| string
| undefined;
if (!value) {
return null;
}
const asyncRefreshHeader: Record<string, unknown> = {};
value.split(/,\s*/).forEach((pair) => {
const [key, val] = pair.split('=', 2);
let typedValue: string | number;
if (key && ['id', 'retry'].includes(key) && val) {
if (val.startsWith('"')) {
typedValue = val.slice(1, -1);
} else {
typedValue = parseInt(val);
}
asyncRefreshHeader[key] = typedValue;
}
});
if (isAsyncRefreshHeader(asyncRefreshHeader)) {
return asyncRefreshHeader;
}
return null;
};
const csrfHeader: RawAxiosRequestHeaders = {};
const setCSRFHeader = () => {
@ -83,7 +127,7 @@ export default function api(withAuthorization = true) {
return instance;
}
type ApiUrl = `v${1 | 2}/${string}`;
type ApiUrl = `v${1 | '1_alpha' | 2}/${string}`;
type RequestParamsOrData = Record<string, unknown>;
export async function apiRequest<ApiResponse = unknown>(

View File

@ -0,0 +1,5 @@
import { apiRequestGet } from 'mastodon/api';
import type { ApiAsyncRefreshJSON } from 'mastodon/api_types/async_refreshes';
export const apiGetAsyncRefresh = (id: string) =>
apiRequestGet<ApiAsyncRefreshJSON>(`v1_alpha/async_refreshes/${id}`);

View File

@ -1,5 +1,14 @@
import { apiRequestGet } from 'mastodon/api';
import api, { getAsyncRefreshHeader } from 'mastodon/api';
import type { ApiContextJSON } from 'mastodon/api_types/statuses';
export const apiGetContext = (statusId: string) =>
apiRequestGet<ApiContextJSON>(`v1/statuses/${statusId}/context`);
export const apiGetContext = async (statusId: string) => {
const response = await api().request<ApiContextJSON>({
method: 'GET',
url: `/api/v1/statuses/${statusId}/context`,
});
return {
context: response.data,
refresh: getAsyncRefreshHeader(response),
};
};

View File

@ -0,0 +1,7 @@
export interface ApiAsyncRefreshJSON {
async_refresh: {
id: string;
status: 'running' | 'finished';
result_count: number;
};
}

View File

@ -0,0 +1,79 @@
import { useEffect } from 'react';
import { useIntl, defineMessages } from 'react-intl';
import classNames from 'classnames';
import {
fetchContext,
completeContextRefresh,
} from 'mastodon/actions/statuses';
import type { AsyncRefreshHeader } from 'mastodon/api';
import { apiGetAsyncRefresh } from 'mastodon/api/async_refreshes';
import { LoadingIndicator } from 'mastodon/components/loading_indicator';
import { useAppSelector, useAppDispatch } from 'mastodon/store';
const messages = defineMessages({
loading: {
id: 'status.context.loading',
defaultMessage: 'Checking for more replies',
},
});
export const RefreshController: React.FC<{
statusId: string;
withBorder?: boolean;
}> = ({ statusId, withBorder }) => {
const refresh = useAppSelector(
(state) => state.contexts.refreshing[statusId],
);
const dispatch = useAppDispatch();
const intl = useIntl();
useEffect(() => {
let timeoutId: ReturnType<typeof setTimeout>;
const scheduleRefresh = (refresh: AsyncRefreshHeader) => {
timeoutId = setTimeout(() => {
void apiGetAsyncRefresh(refresh.id).then((result) => {
if (result.async_refresh.status === 'finished') {
dispatch(completeContextRefresh({ statusId }));
if (result.async_refresh.result_count > 0) {
void dispatch(fetchContext({ statusId }));
}
} else {
scheduleRefresh(refresh);
}
return '';
});
}, refresh.retry * 1000);
};
if (refresh) {
scheduleRefresh(refresh);
}
return () => {
clearTimeout(timeoutId);
};
}, [dispatch, statusId, refresh]);
if (!refresh) {
return null;
}
return (
<div
className={classNames('load-more load-gap', {
'timeline-hint--with-descendants': withBorder,
})}
aria-busy
aria-live='polite'
aria-label={intl.formatMessage(messages.loading)}
>
<LoadingIndicator />
</div>
);
};

View File

@ -69,7 +69,7 @@ import { attachFullscreenListener, detachFullscreenListener, isFullscreen } from
import ActionBar from './components/action_bar';
import { DetailedStatus } from './components/detailed_status';
import { RefreshController } from './components/refresh_controller';
const messages = defineMessages({
revealAll: { id: 'status.show_more_all', defaultMessage: 'Show more for all' },
@ -549,7 +549,7 @@ class Status extends ImmutablePureComponent {
render () {
let ancestors, descendants, remoteHint;
const { isLoading, status, ancestorsIds, descendantsIds, intl, domain, multiColumn, pictureInPicture } = this.props;
const { isLoading, status, ancestorsIds, descendantsIds, refresh, intl, domain, multiColumn, pictureInPicture } = this.props;
const { fullscreen } = this.state;
if (isLoading) {
@ -579,11 +579,9 @@ class Status extends ImmutablePureComponent {
if (!isLocal) {
remoteHint = (
<TimelineHint
className={classNames(!!descendants && 'timeline-hint--with-descendants')}
url={status.get('url')}
message={<FormattedMessage id='hints.threads.replies_may_be_missing' defaultMessage='Replies from other servers may be missing.' />}
label={<FormattedMessage id='hints.threads.see_more' defaultMessage='See more replies on {domain}' values={{ domain: <strong>{status.getIn(['account', 'acct']).split('@')[1]}</strong> }} />}
<RefreshController
statusId={status.get('id')}
withBorder={!!descendants}
/>
);
}

View File

@ -424,8 +424,6 @@
"hints.profiles.see_more_followers": "See more followers on {domain}",
"hints.profiles.see_more_follows": "See more follows on {domain}",
"hints.profiles.see_more_posts": "See more posts on {domain}",
"hints.threads.replies_may_be_missing": "Replies from other servers may be missing.",
"hints.threads.see_more": "See more replies on {domain}",
"home.column_settings.show_quotes": "Show quotes",
"home.column_settings.show_reblogs": "Show boosts",
"home.column_settings.show_replies": "Show replies",
@ -847,6 +845,7 @@
"status.bookmark": "Bookmark",
"status.cancel_reblog_private": "Unboost",
"status.cannot_reblog": "This post cannot be boosted",
"status.context.loading": "Checking for more replies",
"status.continued_thread": "Continued thread",
"status.copy": "Copy link to post",
"status.delete": "Delete",

View File

@ -4,6 +4,7 @@ import type { Draft, UnknownAction } from '@reduxjs/toolkit';
import type { List as ImmutableList } from 'immutable';
import { timelineDelete } from 'mastodon/actions/timelines_typed';
import type { AsyncRefreshHeader } from 'mastodon/api';
import type { ApiRelationshipJSON } from 'mastodon/api_types/relationships';
import type {
ApiStatusJSON,
@ -12,7 +13,7 @@ import type {
import type { Status } from 'mastodon/models/status';
import { blockAccountSuccess, muteAccountSuccess } from '../actions/accounts';
import { fetchContext } from '../actions/statuses';
import { fetchContext, completeContextRefresh } from '../actions/statuses';
import { TIMELINE_UPDATE } from '../actions/timelines';
import { compareId } from '../compare_id';
@ -25,11 +26,13 @@ interface TimelineUpdateAction extends UnknownAction {
interface State {
inReplyTos: Record<string, string>;
replies: Record<string, string[]>;
refreshing: Record<string, AsyncRefreshHeader>;
}
const initialState: State = {
inReplyTos: {},
replies: {},
refreshing: {},
};
const normalizeContext = (
@ -127,6 +130,13 @@ export const contextsReducer = createReducer(initialState, (builder) => {
builder
.addCase(fetchContext.fulfilled, (state, action) => {
normalizeContext(state, action.meta.arg.statusId, action.payload.context);
if (action.payload.refresh) {
state.refreshing[action.meta.arg.statusId] = action.payload.refresh;
}
})
.addCase(completeContextRefresh, (state, action) => {
delete state.refreshing[action.payload.statusId];
})
.addCase(blockAccountSuccess, (state, action) => {
filterContexts(

View File

@ -17,12 +17,14 @@ class CustomFilterStatus < ApplicationRecord
belongs_to :custom_filter
belongs_to :status
validates :status, uniqueness: { scope: :custom_filter }
validate :validate_status_access
validates :status_id, uniqueness: { scope: :custom_filter_id }
validate :validate_status_access, if: [:custom_filter_account, :status]
delegate :account, to: :custom_filter, prefix: true, allow_nil: true
private
def validate_status_access
errors.add(:status_id, :invalid) unless StatusPolicy.new(custom_filter.account, status).show?
errors.add(:status_id, :invalid) unless StatusPolicy.new(custom_filter_account, status).show?
end
end

View File

@ -14,7 +14,7 @@ class FollowRecommendationMute < ApplicationRecord
belongs_to :account
belongs_to :target_account, class_name: 'Account'
validates :target_account, uniqueness: { scope: :account_id }
validates :target_account_id, uniqueness: { scope: :account_id }
after_commit :invalidate_follow_recommendations_cache

View File

@ -90,6 +90,7 @@ class User < ApplicationRecord
has_many :applications, class_name: 'Doorkeeper::Application', as: :owner, dependent: nil
has_many :backups, inverse_of: :user, dependent: nil
has_many :invites, inverse_of: :user, dependent: nil
has_many :login_activities, inverse_of: :user, dependent: :destroy
has_many :markers, inverse_of: :user, dependent: :destroy
has_many :webauthn_credentials, dependent: :destroy
has_many :ips, class_name: 'UserIp', inverse_of: :user, dependent: nil

View File

@ -16,6 +16,7 @@ class ActivityPub::FetchAllRepliesWorker
MAX_PAGES = (ENV['FETCH_REPLIES_MAX_PAGES'] || 500).to_i
def perform(root_status_id, options = {})
@async_refresh = AsyncRefresh.new("context:#{root_status_id}:refresh")
@root_status = Status.remote.find_by(id: root_status_id)
return unless @root_status&.should_fetch_replies?
@ -38,6 +39,7 @@ class ActivityPub::FetchAllRepliesWorker
uris_to_fetch.concat(new_reply_uris)
fetched_uris = fetched_uris.merge(new_reply_uris)
@async_refresh.increment_result_count(by: new_reply_uris.size)
n_pages += new_n_pages
end
@ -45,6 +47,8 @@ class ActivityPub::FetchAllRepliesWorker
# Workers shouldn't be returning anything, but this is used in tests
fetched_uris
ensure
@async_refresh.finish!
end
private

View File

@ -100,11 +100,14 @@ RSpec.describe Auth::SessionsController do
let(:user) { Fabricate(:user, email: 'foo@bar.com', password: 'abcdefgh') }
context 'when using a valid password' do
before do
subject do
post :create, params: { user: { email: user.email, password: user.password } }
end
it 'redirects to home and logs the user in' do
expect { subject }
.to change(user.login_activities.where(success: true), :count).by(1)
expect(response).to redirect_to(root_path)
expect(controller.current_user).to eq user
@ -265,10 +268,9 @@ RSpec.describe Auth::SessionsController do
it 'does not log the user in, sets a flash message, and sends a suspicious sign in email', :inline_jobs do
emails = capture_emails do
Auth::SessionsController::MAX_2FA_ATTEMPTS_PER_HOUR.times do
post :create, params: { user: { otp_attempt: '1234' } }, session: { attempt_user_id: user.id, attempt_user_updated_at: user.updated_at.to_s }
expect(controller.current_user).to be_nil
end
expect { process_maximum_two_factor_attempts }
.to change(user.login_activities.where(success: false), :count).by(1)
post :create, params: { user: { otp_attempt: user.current_otp } }, session: { attempt_user_id: user.id, attempt_user_updated_at: user.updated_at.to_s }
end
@ -286,6 +288,13 @@ RSpec.describe Auth::SessionsController do
subject: eq(I18n.t('user_mailer.failed_2fa.subject'))
)
end
def process_maximum_two_factor_attempts
Auth::SessionsController::MAX_2FA_ATTEMPTS_PER_HOUR.times do
post :create, params: { user: { otp_attempt: '1234' } }, session: { attempt_user_id: user.id, attempt_user_updated_at: user.updated_at.to_s }
expect(controller.current_user).to be_nil
end
end
end
context 'when using a valid OTP' do

View File

@ -0,0 +1,33 @@
# frozen_string_literal: true
require 'rails_helper'
RSpec.describe CustomFilterStatus do
describe 'Associations' do
it { is_expected.to belong_to(:custom_filter) }
it { is_expected.to belong_to(:status) }
end
describe 'Validations' do
subject { Fabricate.build :custom_filter_status }
it { is_expected.to validate_uniqueness_of(:status_id).scoped_to(:custom_filter_id) }
describe 'Status access' do
subject { Fabricate.build :custom_filter_status, custom_filter:, status: }
let(:custom_filter) { Fabricate :custom_filter }
let(:status) { Fabricate :status }
context 'when policy allows filter account to access status' do
it { is_expected.to allow_value(status.id).for(:status_id) }
end
context 'when policy does not allow filter account to access status' do
before { status.account.touch(:suspended_at) }
it { is_expected.to_not allow_value(status.id).for(:status_id) }
end
end
end
end

View File

@ -0,0 +1,30 @@
# frozen_string_literal: true
require 'rails_helper'
RSpec.describe FollowRecommendationMute do
describe 'Associations' do
it { is_expected.to belong_to(:account) }
it { is_expected.to belong_to(:target_account).class_name('Account') }
end
describe 'Validations' do
subject { Fabricate.build :follow_recommendation_mute }
it { is_expected.to validate_uniqueness_of(:target_account_id).scoped_to(:account_id) }
end
describe 'Callbacks' do
describe 'Maintaining the recommendation cache' do
let(:account) { Fabricate :account }
let(:cache_key) { "follow_recommendations/#{account.id}" }
before { Rails.cache.write(cache_key, 123) }
it 'purges on save' do
expect { Fabricate :follow_recommendation_mute, account: account }
.to(change { Rails.cache.exist?(cache_key) }.from(true).to(false))
end
end
end
end

View File

@ -24,6 +24,7 @@ RSpec.describe User do
describe 'Associations' do
it { is_expected.to belong_to(:account).required }
it { is_expected.to have_many(:login_activities) }
end
describe 'Validations' do

View File

@ -5764,7 +5764,7 @@ __metadata:
languageName: node
linkType: hard
"chokidar@npm:^3.5.3":
"chokidar@npm:^3.6.0":
version: 3.6.0
resolution: "chokidar@npm:3.6.0"
dependencies:
@ -11298,8 +11298,8 @@ __metadata:
linkType: hard
"react-select@npm:^5.7.3":
version: 5.10.1
resolution: "react-select@npm:5.10.1"
version: 5.10.2
resolution: "react-select@npm:5.10.2"
dependencies:
"@babel/runtime": "npm:^7.12.0"
"@emotion/cache": "npm:^11.4.0"
@ -11313,7 +11313,7 @@ __metadata:
peerDependencies:
react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
checksum: 10c0/0d10a249b96150bd648f2575d59c848b8fac7f4d368a97ae84e4aaba5bbc1035deba4cdc82e49a43904b79ec50494505809618b0e98022b2d51e7629551912ed
checksum: 10c0/2027ef57b0a375d1accdad60550329dc0911b31d429ec6eb9ae391ae9baf9f26991b0ff8615eb99de319a55ce6e9382107783e615cb2116522ed0275b214b7f7
languageName: node
linkType: hard
@ -13904,17 +13904,17 @@ __metadata:
linkType: hard
"vite-plugin-static-copy@npm:^3.1.0":
version: 3.1.0
resolution: "vite-plugin-static-copy@npm:3.1.0"
version: 3.1.1
resolution: "vite-plugin-static-copy@npm:3.1.1"
dependencies:
chokidar: "npm:^3.5.3"
chokidar: "npm:^3.6.0"
fs-extra: "npm:^11.3.0"
p-map: "npm:^7.0.3"
picocolors: "npm:^1.1.1"
tinyglobby: "npm:^0.2.14"
peerDependencies:
vite: ^5.0.0 || ^6.0.0 || ^7.0.0
checksum: 10c0/dce43f12ecc71417f1afd530d15b316774fe0441c2502e48e2bfafcd07fd4ae90a5782621f932d8d12a8c8213bed6746e80d5452e2fb216ece2bcf7e80309f82
checksum: 10c0/a4dd5d31212b037d4902d55c2ee83866e496857bf948f258599dc24ec61b4628cf0dd23e4a7d7dc189d33ad1489427e976fa95e4db61b394d0be4f63077ef92c
languageName: node
linkType: hard