Merge branch 'develop' into feature/return-link-for-password-reset

11 files changed, 833 insertions, 19 deletions

diff --git a/test/web/activity_pub/transmogrifier_test.exs b/test/web/activity_pub/transmogrifier_test.exs
index ebed65b7c..a35db71dc 100644
--- a/test/web/activity_pub/transmogrifier_test.exs
+++ b/test/web/activity_pub/transmogrifier_test.exs
@@ -1455,4 +1455,271 @@ defmodule Pleroma.Web.ActivityPub.TransmogrifierTest do
       refute recipient.follower_address in fixed_object["to"]
     end
   end
+
+  describe "fix_summary/1" do
+    test "returns fixed object" do
+      assert Transmogrifier.fix_summary(%{"summary" => nil}) == %{"summary" => ""}
+      assert Transmogrifier.fix_summary(%{"summary" => "ok"}) == %{"summary" => "ok"}
+      assert Transmogrifier.fix_summary(%{}) == %{"summary" => ""}
+    end
+  end
+
+  describe "fix_in_reply_to/2" do
+    clear_config([:instance, :federation_incoming_replies_max_depth])
+
+    setup do
+      data = Poison.decode!(File.read!("test/fixtures/mastodon-post-activity.json"))
+      [data: data]
+    end
+
+    test "returns not modified object when hasn't containts inReplyTo field", %{data: data} do
+      assert Transmogrifier.fix_in_reply_to(data) == data
+    end
+
+    test "returns object with inReplyToAtomUri when denied incoming reply", %{data: data} do
+      Pleroma.Config.put([:instance, :federation_incoming_replies_max_depth], 0)
+
+      object_with_reply =
+        Map.put(data["object"], "inReplyTo", "https://shitposter.club/notice/2827873")
+
+      modified_object = Transmogrifier.fix_in_reply_to(object_with_reply)
+      assert modified_object["inReplyTo"] == "https://shitposter.club/notice/2827873"
+      assert modified_object["inReplyToAtomUri"] == "https://shitposter.club/notice/2827873"
+
+      object_with_reply =
+        Map.put(data["object"], "inReplyTo", %{"id" => "https://shitposter.club/notice/2827873"})
+
+      modified_object = Transmogrifier.fix_in_reply_to(object_with_reply)
+      assert modified_object["inReplyTo"] == %{"id" => "https://shitposter.club/notice/2827873"}
+      assert modified_object["inReplyToAtomUri"] == "https://shitposter.club/notice/2827873"
+
+      object_with_reply =
+        Map.put(data["object"], "inReplyTo", ["https://shitposter.club/notice/2827873"])
+
+      modified_object = Transmogrifier.fix_in_reply_to(object_with_reply)
+      assert modified_object["inReplyTo"] == ["https://shitposter.club/notice/2827873"]
+      assert modified_object["inReplyToAtomUri"] == "https://shitposter.club/notice/2827873"
+
+      object_with_reply = Map.put(data["object"], "inReplyTo", [])
+      modified_object = Transmogrifier.fix_in_reply_to(object_with_reply)
+      assert modified_object["inReplyTo"] == []
+      assert modified_object["inReplyToAtomUri"] == ""
+    end
+
+    test "returns modified object when allowed incoming reply", %{data: data} do
+      object_with_reply =
+        Map.put(
+          data["object"],
+          "inReplyTo",
+          "https://shitposter.club/notice/2827873"
+        )
+
+      Pleroma.Config.put([:instance, :federation_incoming_replies_max_depth], 5)
+      modified_object = Transmogrifier.fix_in_reply_to(object_with_reply)
+
+      assert modified_object["inReplyTo"] ==
+               "tag:shitposter.club,2017-05-05:noticeId=2827873:objectType=comment"
+
+      assert modified_object["inReplyToAtomUri"] == "https://shitposter.club/notice/2827873"
+
+      assert modified_object["conversation"] ==
+               "tag:shitposter.club,2017-05-05:objectType=thread:nonce=3c16e9c2681f6d26"
+
+      assert modified_object["context"] ==
+               "tag:shitposter.club,2017-05-05:objectType=thread:nonce=3c16e9c2681f6d26"
+    end
+  end
+
+  describe "fix_url/1" do
+    test "fixes data for object when url is map" do
+      object = %{
+        "url" => %{
+          "type" => "Link",
+          "mimeType" => "video/mp4",
+          "href" => "https://peede8d-46fb-ad81-2d4c2d1630e3-480.mp4"
+        }
+      }
+
+      assert Transmogrifier.fix_url(object) == %{
+               "url" => "https://peede8d-46fb-ad81-2d4c2d1630e3-480.mp4"
+             }
+    end
+
+    test "fixes data for video object" do
+      object = %{
+        "type" => "Video",
+        "url" => [
+          %{
+            "type" => "Link",
+            "mimeType" => "video/mp4",
+            "href" => "https://peede8d-46fb-ad81-2d4c2d1630e3-480.mp4"
+          },
+          %{
+            "type" => "Link",
+            "mimeType" => "video/mp4",
+            "href" => "https://peertube46fb-ad81-2d4c2d1630e3-240.mp4"
+          },
+          %{
+            "type" => "Link",
+            "mimeType" => "text/html",
+            "href" => "https://peertube.-2d4c2d1630e3"
+          },
+          %{
+            "type" => "Link",
+            "mimeType" => "text/html",
+            "href" => "https://peertube.-2d4c2d16377-42"
+          }
+        ]
+      }
+
+      assert Transmogrifier.fix_url(object) == %{
+               "attachment" => [
+                 %{
+                   "href" => "https://peede8d-46fb-ad81-2d4c2d1630e3-480.mp4",
+                   "mimeType" => "video/mp4",
+                   "type" => "Link"
+                 }
+               ],
+               "type" => "Video",
+               "url" => "https://peertube.-2d4c2d1630e3"
+             }
+    end
+
+    test "fixes url for not Video object" do
+      object = %{
+        "type" => "Text",
+        "url" => [
+          %{
+            "type" => "Link",
+            "mimeType" => "text/html",
+            "href" => "https://peertube.-2d4c2d1630e3"
+          },
+          %{
+            "type" => "Link",
+            "mimeType" => "text/html",
+            "href" => "https://peertube.-2d4c2d16377-42"
+          }
+        ]
+      }
+
+      assert Transmogrifier.fix_url(object) == %{
+               "type" => "Text",
+               "url" => "https://peertube.-2d4c2d1630e3"
+             }
+
+      assert Transmogrifier.fix_url(%{"type" => "Text", "url" => []}) == %{
+               "type" => "Text",
+               "url" => ""
+             }
+    end
+
+    test "retunrs not modified object" do
+      assert Transmogrifier.fix_url(%{"type" => "Text"}) == %{"type" => "Text"}
+    end
+  end
+
+  describe "get_obj_helper/2" do
+    test "returns nil when cannot normalize object" do
+      refute Transmogrifier.get_obj_helper("test-obj-id")
+    end
+
+    test "returns {:ok, %Object{}} for success case" do
+      assert {:ok, %Object{}} =
+               Transmogrifier.get_obj_helper("https://shitposter.club/notice/2827873")
+    end
+  end
+
+  describe "fix_attachments/1" do
+    test "returns not modified object" do
+      data = Poison.decode!(File.read!("test/fixtures/mastodon-post-activity.json"))
+      assert Transmogrifier.fix_attachments(data) == data
+    end
+
+    test "returns modified object when attachment is map" do
+      assert Transmogrifier.fix_attachments(%{
+               "attachment" => %{
+                 "mediaType" => "video/mp4",
+                 "url" => "https://peertube.moe/stat-480.mp4"
+               }
+             }) == %{
+               "attachment" => [
+                 %{
+                   "mediaType" => "video/mp4",
+                   "url" => [
+                     %{
+                       "href" => "https://peertube.moe/stat-480.mp4",
+                       "mediaType" => "video/mp4",
+                       "type" => "Link"
+                     }
+                   ]
+                 }
+               ]
+             }
+    end
+
+    test "returns modified object when attachment is list" do
+      assert Transmogrifier.fix_attachments(%{
+               "attachment" => [
+                 %{"mediaType" => "video/mp4", "url" => "https://pe.er/stat-480.mp4"},
+                 %{"mimeType" => "video/mp4", "href" => "https://pe.er/stat-480.mp4"}
+               ]
+             }) == %{
+               "attachment" => [
+                 %{
+                   "mediaType" => "video/mp4",
+                   "url" => [
+                     %{
+                       "href" => "https://pe.er/stat-480.mp4",
+                       "mediaType" => "video/mp4",
+                       "type" => "Link"
+                     }
+                   ]
+                 },
+                 %{
+                   "href" => "https://pe.er/stat-480.mp4",
+                   "mediaType" => "video/mp4",
+                   "mimeType" => "video/mp4",
+                   "url" => [
+                     %{
+                       "href" => "https://pe.er/stat-480.mp4",
+                       "mediaType" => "video/mp4",
+                       "type" => "Link"
+                     }
+                   ]
+                 }
+               ]
+             }
+    end
+  end
+
+  describe "fix_emoji/1" do
+    test "returns not modified object when object not contains tags" do
+      data = Poison.decode!(File.read!("test/fixtures/mastodon-post-activity.json"))
+      assert Transmogrifier.fix_emoji(data) == data
+    end
+
+    test "returns object with emoji when object contains list tags" do
+      assert Transmogrifier.fix_emoji(%{
+               "tag" => [
+                 %{"type" => "Emoji", "name" => ":bib:", "icon" => %{"url" => "/test"}},
+                 %{"type" => "Hashtag"}
+               ]
+             }) == %{
+               "emoji" => %{"bib" => "/test"},
+               "tag" => [
+                 %{"icon" => %{"url" => "/test"}, "name" => ":bib:", "type" => "Emoji"},
+                 %{"type" => "Hashtag"}
+               ]
+             }
+    end
+
+    test "returns object with emoji when object contains map tag" do
+      assert Transmogrifier.fix_emoji(%{
+               "tag" => %{"type" => "Emoji", "name" => ":bib:", "icon" => %{"url" => "/test"}}
+             }) == %{
+               "emoji" => %{"bib" => "/test"},
+               "tag" => %{"icon" => %{"url" => "/test"}, "name" => ":bib:", "type" => "Emoji"}
+             }
+    end
+  end
 end
diff --git a/test/web/activity_pub/views/user_view_test.exs b/test/web/activity_pub/views/user_view_test.exs
index eda95e3ea..78b0408ee 100644
--- a/test/web/activity_pub/views/user_view_test.exs
+++ b/test/web/activity_pub/views/user_view_test.exs
@@ -37,6 +37,22 @@ defmodule Pleroma.Web.ActivityPub.UserViewTest do
            } = UserView.render("user.json", %{user: user})
   end
 
+  test "Renders with emoji tags" do
+    user = insert(:user, %{info: %{emoji: [%{"bib" => "/test"}]}})
+
+    assert %{
+             "tag" => [
+               %{
+                 "icon" => %{"type" => "Image", "url" => "/test"},
+                 "id" => "/test",
+                 "name" => ":bib:",
+                 "type" => "Emoji",
+                 "updated" => "1970-01-01T00:00:00Z"
+               }
+             ]
+           } = UserView.render("user.json", %{user: user})
+  end
+
   test "Does not add an avatar image if the user hasn't set one" do
     user = insert(:user)
     {:ok, user} = User.ensure_keys_present(user)
diff --git a/test/web/admin_api/admin_api_controller_test.exs b/test/web/admin_api/admin_api_controller_test.exs
index a66b0f517..00e64692a 100644
--- a/test/web/admin_api/admin_api_controller_test.exs
+++ b/test/web/admin_api/admin_api_controller_test.exs
@@ -4,11 +4,13 @@
 
 defmodule Pleroma.Web.AdminAPI.AdminAPIControllerTest do
   use Pleroma.Web.ConnCase
+  use Oban.Testing, repo: Pleroma.Repo
 
   alias Pleroma.Activity
   alias Pleroma.HTML
   alias Pleroma.ModerationLog
   alias Pleroma.Repo
+  alias Pleroma.Tests.ObanHelpers
   alias Pleroma.User
   alias Pleroma.UserInviteToken
   alias Pleroma.Web.CommonAPI
@@ -2353,6 +2355,30 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIControllerTest do
                "@#{admin.nickname} followed relay: https://example.org/relay"
     end
   end
+
+  describe "PATCH /users/:nickname/force_password_reset" do
+    setup %{conn: conn} do
+      admin = insert(:user, info: %{is_admin: true})
+      user = insert(:user)
+
+      %{conn: assign(conn, :user, admin), admin: admin, user: user}
+    end
+
+    test "sets password_reset_pending to true", %{admin: admin, user: user} do
+      assert user.info.password_reset_pending == false
+
+      conn =
+        build_conn()
+        |> assign(:user, admin)
+        |> patch("/api/pleroma/admin/users/#{user.nickname}/force_password_reset")
+
+      assert json_response(conn, 204) == ""
+
+      ObanHelpers.perform_all()
+
+      assert User.get_by_id(user.id).info.password_reset_pending == true
+    end
+  end
 end
 
 # Needed for testing
diff --git a/test/web/admin_api/views/report_view_test.exs b/test/web/admin_api/views/report_view_test.exs
index a00c9c579..40df01101 100644
--- a/test/web/admin_api/views/report_view_test.exs
+++ b/test/web/admin_api/views/report_view_test.exs
@@ -5,6 +5,7 @@
 defmodule Pleroma.Web.AdminAPI.ReportViewTest do
   use Pleroma.DataCase
   import Pleroma.Factory
+  alias Pleroma.Web.AdminAPI.Report
   alias Pleroma.Web.AdminAPI.ReportView
   alias Pleroma.Web.CommonAPI
   alias Pleroma.Web.MastodonAPI.AccountView
@@ -34,7 +35,7 @@ defmodule Pleroma.Web.AdminAPI.ReportViewTest do
     }
 
     result =
-      ReportView.render("show.json", %{report: activity})
+      ReportView.render("show.json", Report.extract_report_info(activity))
       |> Map.delete(:created_at)
 
     assert result == expected
@@ -66,7 +67,7 @@ defmodule Pleroma.Web.AdminAPI.ReportViewTest do
     }
 
     result =
-      ReportView.render("show.json", %{report: report_activity})
+      ReportView.render("show.json", Report.extract_report_info(report_activity))
       |> Map.delete(:created_at)
 
     assert result == expected
@@ -78,7 +79,9 @@ defmodule Pleroma.Web.AdminAPI.ReportViewTest do
 
     {:ok, activity} = CommonAPI.report(user, %{"account_id" => other_user.id})
     {:ok, activity} = CommonAPI.update_report_state(activity.id, "closed")
-    assert %{state: "closed"} = ReportView.render("show.json", %{report: activity})
+
+    assert %{state: "closed"} =
+             ReportView.render("show.json", Report.extract_report_info(activity))
   end
 
   test "renders report description" do
@@ -92,7 +95,7 @@ defmodule Pleroma.Web.AdminAPI.ReportViewTest do
       })
 
     assert %{content: "posts are too good for this instance"} =
-             ReportView.render("show.json", %{report: activity})
+             ReportView.render("show.json", Report.extract_report_info(activity))
   end
 
   test "sanitizes report description" do
@@ -109,7 +112,7 @@ defmodule Pleroma.Web.AdminAPI.ReportViewTest do
     activity = Map.put(activity, :data, data)
 
     refute "<script> alert('hecked :D:D:D:D:D:D:D') </script>" ==
-             ReportView.render("show.json", %{report: activity})[:content]
+             ReportView.render("show.json", Report.extract_report_info(activity))[:content]
   end
 
   test "doesn't error out when the user doesn't exists" do
@@ -125,6 +128,6 @@ defmodule Pleroma.Web.AdminAPI.ReportViewTest do
     Pleroma.User.delete(other_user)
     Pleroma.User.invalidate_cache(other_user)
 
-    assert %{} = ReportView.render("show.json", %{report: activity})
+    assert %{} = ReportView.render("show.json", Report.extract_report_info(activity))
   end
 end
diff --git a/test/web/common_api/common_api_utils_test.exs b/test/web/common_api/common_api_utils_test.exs
index 230146451..2588898d0 100644
--- a/test/web/common_api/common_api_utils_test.exs
+++ b/test/web/common_api/common_api_utils_test.exs
@@ -157,11 +157,11 @@ defmodule Pleroma.Web.CommonAPI.UtilsTest do
       text = "**hello world**\n\n*another @user__test and @user__test google.com paragraph*"
 
       expected =
-        "<p><strong>hello world</strong></p>\n<p><em>another <span class=\"h-card\"><a data-user=\"#{
+        ~s(<p><strong>hello world</strong></p>\n<p><em>another <span class="h-card"><a data-user="#{
           user.id
-        }\" class=\"u-url mention\" href=\"http://foo.com/user__test\">@<span>user__test</span></a></span> and <span class=\"h-card\"><a data-user=\"#{
+        }" class="u-url mention" href="http://foo.com/user__test" rel="ugc">@<span>user__test</span></a></span> and <span class="h-card"><a data-user="#{
           user.id
-        }\" class=\"u-url mention\" href=\"http://foo.com/user__test\">@<span>user__test</span></a></span> <a href=\"http://google.com\">google.com</a> paragraph</em></p>\n"
+        }" class="u-url mention" href="http://foo.com/user__test" rel="ugc">@<span>user__test</span></a></span> <a href="http://google.com" rel="ugc">google.com</a> paragraph</em></p>\n)
 
       {output, _, _} = Utils.format_input(text, "text/markdown")
 
diff --git a/test/web/mastodon_api/controllers/mastodon_api_controller/update_credentials_test.exs b/test/web/mastodon_api/controllers/mastodon_api_controller/update_credentials_test.exs
index 89d4ca37e..560f55137 100644
--- a/test/web/mastodon_api/controllers/mastodon_api_controller/update_credentials_test.exs
+++ b/test/web/mastodon_api/controllers/mastodon_api_controller/update_credentials_test.exs
@@ -86,10 +86,9 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController.UpdateCredentialsTest do
       assert user = json_response(conn, 200)
 
       assert user["note"] ==
-               ~s(I drink <a class="hashtag" data-tag="cofe" href="http://localhost:4001/tag/cofe" rel="tag">#cofe</a> with <span class="h-card"><a data-user=") <>
-                 user2.id <>
-                 ~s(" class="u-url mention" href=") <>
-                 user2.ap_id <> ~s(">@<span>) <> user2.nickname <> ~s(</span></a></span>)
+               ~s(I drink <a class="hashtag" data-tag="cofe" href="http://localhost:4001/tag/cofe">#cofe</a> with <span class="h-card"><a data-user="#{
+                 user2.id
+               }" class="u-url mention" href="#{user2.ap_id}" rel="ugc">@<span>#{user2.nickname}</span></a></span>)
     end
 
     test "updates the user's locking status", %{conn: conn} do
@@ -334,7 +333,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController.UpdateCredentialsTest do
 
       assert account["fields"] == [
                %{"name" => "foo", "value" => "bar"},
-               %{"name" => "link", "value" => "<a href=\"http://cofe.io\">cofe.io</a>"}
+               %{"name" => "link", "value" => ~S(<a href="http://cofe.io" rel="ugc">cofe.io</a>)}
              ]
 
       assert account["source"]["fields"] == [
diff --git a/test/web/mastodon_api/mastodon_api_controller_test.exs b/test/web/mastodon_api/mastodon_api_controller_test.exs
index 35a0d3fe1..73a3bf135 100644
--- a/test/web/mastodon_api/mastodon_api_controller_test.exs
+++ b/test/web/mastodon_api/mastodon_api_controller_test.exs
@@ -97,6 +97,22 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIControllerTest do
            |> json_response(403) == %{"error" => "This resource requires authentication."}
   end
 
+  test "the public timeline includes only public statuses for an authenticated user" do
+    user = insert(:user)
+
+    conn =
+      build_conn()
+      |> assign(:user, user)
+
+    {:ok, _activity} = CommonAPI.post(user, %{"status" => "test"})
+    {:ok, _activity} = CommonAPI.post(user, %{"status" => "test", "visibility" => "private"})
+    {:ok, _activity} = CommonAPI.post(user, %{"status" => "test", "visibility" => "unlisted"})
+    {:ok, _activity} = CommonAPI.post(user, %{"status" => "test", "visibility" => "direct"})
+
+    res_conn = get(conn, "/api/v1/timelines/public")
+    assert length(json_response(res_conn, 200)) == 1
+  end
+
   describe "posting statuses" do
     setup do
       user = insert(:user)
@@ -998,9 +1014,9 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIControllerTest do
         |> get("/api/v1/notifications")
 
       expected_response =
-        "hi <span class=\"h-card\"><a data-user=\"#{user.id}\" class=\"u-url mention\" href=\"#{
+        ~s(hi <span class="h-card"><a data-user="#{user.id}" class="u-url mention" href="#{
           user.ap_id
-        }\">@<span>#{user.nickname}</span></a></span>"
+        }" rel="ugc">@<span>#{user.nickname}</span></a></span>)
 
       assert [%{"status" => %{"content" => response}} | _rest] = json_response(conn, 200)
       assert response == expected_response
@@ -1020,9 +1036,9 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIControllerTest do
         |> get("/api/v1/notifications/#{notification.id}")
 
       expected_response =
-        "hi <span class=\"h-card\"><a data-user=\"#{user.id}\" class=\"u-url mention\" href=\"#{
+        ~s(hi <span class="h-card"><a data-user="#{user.id}" class="u-url mention" href="#{
           user.ap_id
-        }\">@<span>#{user.nickname}</span></a></span>"
+        }" rel="ugc">@<span>#{user.nickname}</span></a></span>)
 
       assert %{"status" => %{"content" => response}} = json_response(conn, 200)
       assert response == expected_response
diff --git a/test/web/oauth/oauth_controller_test.exs b/test/web/oauth/oauth_controller_test.exs
index 2780e1746..8b88fd784 100644
--- a/test/web/oauth/oauth_controller_test.exs
+++ b/test/web/oauth/oauth_controller_test.exs
@@ -831,6 +831,33 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
       refute Map.has_key?(resp, "access_token")
     end
 
+    test "rejects token exchange for user with password_reset_pending set to true" do
+      password = "testpassword"
+
+      user =
+        insert(:user,
+          password_hash: Comeonin.Pbkdf2.hashpwsalt(password),
+          info: %{password_reset_pending: true}
+        )
+
+      app = insert(:oauth_app, scopes: ["read", "write"])
+
+      conn =
+        build_conn()
+        |> post("/oauth/token", %{
+          "grant_type" => "password",
+          "username" => user.nickname,
+          "password" => password,
+          "client_id" => app.client_id,
+          "client_secret" => app.client_secret
+        })
+
+      assert resp = json_response(conn, 403)
+
+      assert resp["error"] == "Password reset is required"
+      refute Map.has_key?(resp, "access_token")
+    end
+
     test "rejects an invalid authorization code" do
       app = insert(:oauth_app)
 
diff --git a/test/web/pleroma_api/emoji_api_controller_test.exs b/test/web/pleroma_api/emoji_api_controller_test.exs
new file mode 100644
index 000000000..c5a553692
--- /dev/null
+++ b/test/web/pleroma_api/emoji_api_controller_test.exs
@@ -0,0 +1,437 @@
+defmodule Pleroma.Web.PleromaAPI.EmojiAPIControllerTest do
+  use Pleroma.Web.ConnCase
+
+  import Tesla.Mock
+
+  import Pleroma.Factory
+
+  @emoji_dir_path Path.join(
+                    Pleroma.Config.get!([:instance, :static_dir]),
+                    "emoji"
+                  )
+
+  test "shared & non-shared pack information in list_packs is ok" do
+    conn = build_conn()
+    resp = conn |> get(emoji_api_path(conn, :list_packs)) |> json_response(200)
+
+    assert Map.has_key?(resp, "test_pack")
+
+    pack = resp["test_pack"]
+
+    assert Map.has_key?(pack["pack"], "download-sha256")
+    assert pack["pack"]["can-download"]
+
+    assert pack["files"] == %{"blank" => "blank.png"}
+
+    # Non-shared pack
+
+    assert Map.has_key?(resp, "test_pack_nonshared")
+
+    pack = resp["test_pack_nonshared"]
+
+    refute pack["pack"]["shared"]
+    refute pack["pack"]["can-download"]
+  end
+
+  test "downloading a shared pack from download_shared" do
+    conn = build_conn()
+
+    resp =
+      conn
+      |> get(emoji_api_path(conn, :download_shared, "test_pack"))
+      |> response(200)
+
+    {:ok, arch} = :zip.unzip(resp, [:memory])
+
+    assert Enum.find(arch, fn {n, _} -> n == 'pack.json' end)
+    assert Enum.find(arch, fn {n, _} -> n == 'blank.png' end)
+  end
+
+  test "downloading shared & unshared packs from another instance via download_from, deleting them" do
+    on_exit(fn ->
+      File.rm_rf!("#{@emoji_dir_path}/test_pack2")
+      File.rm_rf!("#{@emoji_dir_path}/test_pack_nonshared2")
+    end)
+
+    mock(fn
+      %{method: :get, url: "https://old-instance/.well-known/nodeinfo"} ->
+        json([%{href: "https://old-instance/nodeinfo/2.1.json"}])
+
+      %{method: :get, url: "https://old-instance/nodeinfo/2.1.json"} ->
+        json(%{metadata: %{features: []}})
+
+      %{method: :get, url: "https://example.com/.well-known/nodeinfo"} ->
+        json([%{href: "https://example.com/nodeinfo/2.1.json"}])
+
+      %{method: :get, url: "https://example.com/nodeinfo/2.1.json"} ->
+        json(%{metadata: %{features: ["shareable_emoji_packs"]}})
+
+      %{
+        method: :get,
+        url: "https://example.com/api/pleroma/emoji/packs/list"
+      } ->
+        conn = build_conn()
+
+        conn
+        |> get(emoji_api_path(conn, :list_packs))
+        |> json_response(200)
+        |> json()
+
+      %{
+        method: :get,
+        url: "https://example.com/api/pleroma/emoji/packs/download_shared/test_pack"
+      } ->
+        conn = build_conn()
+
+        conn
+        |> get(emoji_api_path(conn, :download_shared, "test_pack"))
+        |> response(200)
+        |> text()
+
+      %{
+        method: :get,
+        url: "https://nonshared-pack"
+      } ->
+        text(File.read!("#{@emoji_dir_path}/test_pack_nonshared/nonshared.zip"))
+    end)
+
+    admin = insert(:user, info: %{is_admin: true})
+
+    conn = build_conn() |> assign(:user, admin)
+
+    assert (conn
+            |> put_req_header("content-type", "application/json")
+            |> post(
+              emoji_api_path(
+                conn,
+                :download_from
+              ),
+              %{
+                instance_address: "https://old-instance",
+                pack_name: "test_pack",
+                as: "test_pack2"
+              }
+              |> Jason.encode!()
+            )
+            |> json_response(500))["error"] =~ "does not support"
+
+    assert conn
+           |> put_req_header("content-type", "application/json")
+           |> post(
+             emoji_api_path(
+               conn,
+               :download_from
+             ),
+             %{
+               instance_address: "https://example.com",
+               pack_name: "test_pack",
+               as: "test_pack2"
+             }
+             |> Jason.encode!()
+           )
+           |> json_response(200) == "ok"
+
+    assert File.exists?("#{@emoji_dir_path}/test_pack2/pack.json")
+    assert File.exists?("#{@emoji_dir_path}/test_pack2/blank.png")
+
+    assert conn
+           |> delete(emoji_api_path(conn, :delete, "test_pack2"))
+           |> json_response(200) == "ok"
+
+    refute File.exists?("#{@emoji_dir_path}/test_pack2")
+
+    # non-shared, downloaded from the fallback URL
+
+    conn = build_conn() |> assign(:user, admin)
+
+    assert conn
+           |> put_req_header("content-type", "application/json")
+           |> post(
+             emoji_api_path(
+               conn,
+               :download_from
+             ),
+             %{
+               instance_address: "https://example.com",
+               pack_name: "test_pack_nonshared",
+               as: "test_pack_nonshared2"
+             }
+             |> Jason.encode!()
+           )
+           |> json_response(200) == "ok"
+
+    assert File.exists?("#{@emoji_dir_path}/test_pack_nonshared2/pack.json")
+    assert File.exists?("#{@emoji_dir_path}/test_pack_nonshared2/blank.png")
+
+    assert conn
+           |> delete(emoji_api_path(conn, :delete, "test_pack_nonshared2"))
+           |> json_response(200) == "ok"
+
+    refute File.exists?("#{@emoji_dir_path}/test_pack_nonshared2")
+  end
+
+  describe "updating pack metadata" do
+    setup do
+      pack_file = "#{@emoji_dir_path}/test_pack/pack.json"
+      original_content = File.read!(pack_file)
+
+      on_exit(fn ->
+        File.write!(pack_file, original_content)
+      end)
+
+      {:ok,
+       admin: insert(:user, info: %{is_admin: true}),
+       pack_file: pack_file,
+       new_data: %{
+         "license" => "Test license changed",
+         "homepage" => "https://pleroma.social",
+         "description" => "Test description",
+         "share-files" => false
+       }}
+    end
+
+    test "for a pack without a fallback source", ctx do
+      conn = build_conn()
+
+      assert conn
+             |> assign(:user, ctx[:admin])
+             |> post(
+               emoji_api_path(conn, :update_metadata, "test_pack"),
+               %{
+                 "new_data" => ctx[:new_data]
+               }
+             )
+             |> json_response(200) == ctx[:new_data]
+
+      assert Jason.decode!(File.read!(ctx[:pack_file]))["pack"] == ctx[:new_data]
+    end
+
+    test "for a pack with a fallback source", ctx do
+      mock(fn
+        %{
+          method: :get,
+          url: "https://nonshared-pack"
+        } ->
+          text(File.read!("#{@emoji_dir_path}/test_pack_nonshared/nonshared.zip"))
+      end)
+
+      new_data = Map.put(ctx[:new_data], "fallback-src", "https://nonshared-pack")
+
+      new_data_with_sha =
+        Map.put(
+          new_data,
+          "fallback-src-sha256",
+          "74409E2674DAA06C072729C6C8426C4CB3B7E0B85ED77792DB7A436E11D76DAF"
+        )
+
+      conn = build_conn()
+
+      assert conn
+             |> assign(:user, ctx[:admin])
+             |> post(
+               emoji_api_path(conn, :update_metadata, "test_pack"),
+               %{
+                 "new_data" => new_data
+               }
+             )
+             |> json_response(200) == new_data_with_sha
+
+      assert Jason.decode!(File.read!(ctx[:pack_file]))["pack"] == new_data_with_sha
+    end
+
+    test "when the fallback source doesn't have all the files", ctx do
+      mock(fn
+        %{
+          method: :get,
+          url: "https://nonshared-pack"
+        } ->
+          {:ok, {'empty.zip', empty_arch}} = :zip.zip('empty.zip', [], [:memory])
+          text(empty_arch)
+      end)
+
+      new_data = Map.put(ctx[:new_data], "fallback-src", "https://nonshared-pack")
+
+      conn = build_conn()
+
+      assert (conn
+              |> assign(:user, ctx[:admin])
+              |> post(
+                emoji_api_path(conn, :update_metadata, "test_pack"),
+                %{
+                  "new_data" => new_data
+                }
+              )
+              |> json_response(:bad_request))["error"] =~ "does not have all"
+    end
+  end
+
+  test "updating pack files" do
+    pack_file = "#{@emoji_dir_path}/test_pack/pack.json"
+    original_content = File.read!(pack_file)
+
+    on_exit(fn ->
+      File.write!(pack_file, original_content)
+
+      File.rm_rf!("#{@emoji_dir_path}/test_pack/blank_url.png")
+      File.rm_rf!("#{@emoji_dir_path}/test_pack/dir")
+      File.rm_rf!("#{@emoji_dir_path}/test_pack/dir_2")
+    end)
+
+    admin = insert(:user, info: %{is_admin: true})
+
+    conn = build_conn()
+
+    same_name = %{
+      "action" => "add",
+      "shortcode" => "blank",
+      "filename" => "dir/blank.png",
+      "file" => %Plug.Upload{
+        filename: "blank.png",
+        path: "#{@emoji_dir_path}/test_pack/blank.png"
+      }
+    }
+
+    different_name = %{same_name | "shortcode" => "blank_2"}
+
+    conn = conn |> assign(:user, admin)
+
+    assert (conn
+            |> post(emoji_api_path(conn, :update_file, "test_pack"), same_name)
+            |> json_response(:conflict))["error"] =~ "already exists"
+
+    assert conn
+           |> post(emoji_api_path(conn, :update_file, "test_pack"), different_name)
+           |> json_response(200) == %{"blank" => "blank.png", "blank_2" => "dir/blank.png"}
+
+    assert File.exists?("#{@emoji_dir_path}/test_pack/dir/blank.png")
+
+    assert conn
+           |> post(emoji_api_path(conn, :update_file, "test_pack"), %{
+             "action" => "update",
+             "shortcode" => "blank_2",
+             "new_shortcode" => "blank_3",
+             "new_filename" => "dir_2/blank_3.png"
+           })
+           |> json_response(200) == %{"blank" => "blank.png", "blank_3" => "dir_2/blank_3.png"}
+
+    refute File.exists?("#{@emoji_dir_path}/test_pack/dir/")
+    assert File.exists?("#{@emoji_dir_path}/test_pack/dir_2/blank_3.png")
+
+    assert conn
+           |> post(emoji_api_path(conn, :update_file, "test_pack"), %{
+             "action" => "remove",
+             "shortcode" => "blank_3"
+           })
+           |> json_response(200) == %{"blank" => "blank.png"}
+
+    refute File.exists?("#{@emoji_dir_path}/test_pack/dir_2/")
+
+    mock(fn
+      %{
+        method: :get,
+        url: "https://test-blank/blank_url.png"
+      } ->
+        text(File.read!("#{@emoji_dir_path}/test_pack/blank.png"))
+    end)
+
+    # The name should be inferred from the URL ending
+    from_url = %{
+      "action" => "add",
+      "shortcode" => "blank_url",
+      "file" => "https://test-blank/blank_url.png"
+    }
+
+    assert conn
+           |> post(emoji_api_path(conn, :update_file, "test_pack"), from_url)
+           |> json_response(200) == %{
+             "blank" => "blank.png",
+             "blank_url" => "blank_url.png"
+           }
+
+    assert File.exists?("#{@emoji_dir_path}/test_pack/blank_url.png")
+
+    assert conn
+           |> post(emoji_api_path(conn, :update_file, "test_pack"), %{
+             "action" => "remove",
+             "shortcode" => "blank_url"
+           })
+           |> json_response(200) == %{"blank" => "blank.png"}
+
+    refute File.exists?("#{@emoji_dir_path}/test_pack/blank_url.png")
+  end
+
+  test "creating and deleting a pack" do
+    on_exit(fn ->
+      File.rm_rf!("#{@emoji_dir_path}/test_created")
+    end)
+
+    admin = insert(:user, info: %{is_admin: true})
+
+    conn = build_conn() |> assign(:user, admin)
+
+    assert conn
+           |> put_req_header("content-type", "application/json")
+           |> put(
+             emoji_api_path(
+               conn,
+               :create,
+               "test_created"
+             )
+           )
+           |> json_response(200) == "ok"
+
+    assert File.exists?("#{@emoji_dir_path}/test_created/pack.json")
+
+    assert Jason.decode!(File.read!("#{@emoji_dir_path}/test_created/pack.json")) == %{
+             "pack" => %{},
+             "files" => %{}
+           }
+
+    assert conn
+           |> delete(emoji_api_path(conn, :delete, "test_created"))
+           |> json_response(200) == "ok"
+
+    refute File.exists?("#{@emoji_dir_path}/test_created/pack.json")
+  end
+
+  test "filesystem import" do
+    on_exit(fn ->
+      File.rm!("#{@emoji_dir_path}/test_pack_for_import/emoji.txt")
+      File.rm!("#{@emoji_dir_path}/test_pack_for_import/pack.json")
+    end)
+
+    conn = build_conn()
+    resp = conn |> get(emoji_api_path(conn, :list_packs)) |> json_response(200)
+
+    refute Map.has_key?(resp, "test_pack_for_import")
+
+    admin = insert(:user, info: %{is_admin: true})
+
+    assert conn
+           |> assign(:user, admin)
+           |> post(emoji_api_path(conn, :import_from_fs))
+           |> json_response(200) == ["test_pack_for_import"]
+
+    resp = conn |> get(emoji_api_path(conn, :list_packs)) |> json_response(200)
+    assert resp["test_pack_for_import"]["files"] == %{"blank" => "blank.png"}
+
+    File.rm!("#{@emoji_dir_path}/test_pack_for_import/pack.json")
+    refute File.exists?("#{@emoji_dir_path}/test_pack_for_import/pack.json")
+
+    emoji_txt_content = "blank, blank.png, Fun\n\nblank2, blank.png"
+
+    File.write!("#{@emoji_dir_path}/test_pack_for_import/emoji.txt", emoji_txt_content)
+
+    assert conn
+           |> assign(:user, admin)
+           |> post(emoji_api_path(conn, :import_from_fs))
+           |> json_response(200) == ["test_pack_for_import"]
+
+    resp = conn |> get(emoji_api_path(conn, :list_packs)) |> json_response(200)
+
+    assert resp["test_pack_for_import"]["files"] == %{
+             "blank" => "blank.png",
+             "blank2" => "blank.png"
+           }
+  end
+end
diff --git a/test/web/twitter_api/password_controller_test.exs b/test/web/twitter_api/password_controller_test.exs
index 3a7246ea8..dc6d4e3e3 100644
--- a/test/web/twitter_api/password_controller_test.exs
+++ b/test/web/twitter_api/password_controller_test.exs
@@ -6,6 +6,7 @@ defmodule Pleroma.Web.TwitterAPI.PasswordControllerTest do
   use Pleroma.Web.ConnCase
 
   alias Pleroma.PasswordResetToken
+  alias Pleroma.User
   alias Pleroma.Web.OAuth.Token
   import Pleroma.Factory
 
@@ -56,5 +57,25 @@ defmodule Pleroma.Web.TwitterAPI.PasswordControllerTest do
       assert Comeonin.Pbkdf2.checkpw("test", user.password_hash)
       assert length(Token.get_user_tokens(user)) == 0
     end
+
+    test "it sets password_reset_pending to false", %{conn: conn} do
+      user = insert(:user, info: %{password_reset_pending: true})
+
+      {:ok, token} = PasswordResetToken.create_token(user)
+      {:ok, _access_token} = Token.create_token(insert(:oauth_app), user, %{})
+
+      params = %{
+        "password" => "test",
+        password_confirmation: "test",
+        token: token.token
+      }
+
+      conn
+      |> assign(:user, user)
+      |> post("/api/pleroma/password_reset", %{data: params})
+      |> html_response(:ok)
+
+      assert User.get_by_id(user.id).info.password_reset_pending == false
+    end
   end
 end
diff --git a/test/web/twitter_api/twitter_api_test.exs b/test/web/twitter_api/twitter_api_test.exs
index 08f264431..bf1e233f5 100644
--- a/test/web/twitter_api/twitter_api_test.exs
+++ b/test/web/twitter_api/twitter_api_test.exs
@@ -109,7 +109,9 @@ defmodule Pleroma.Web.TwitterAPI.TwitterAPITest do
     {:ok, user2} = TwitterAPI.register_user(data2)
 
     expected_text =
-      "<span class='h-card'><a data-user='#{user1.id}' class='u-url mention' href='#{user1.ap_id}'>@<span>john</span></a></span> test"
+      ~s(<span class="h-card"><a data-user="#{user1.id}" class="u-url mention" href="#{
+        user1.ap_id
+      }" rel="ugc">@<span>john</span></a></span> test)
 
     assert user2.bio == expected_text
   end