Gab Social. All are welcome.

spec/controllers/api/v1/accounts/credentials_controller_spec.rb

@@ -0,0 +1,93 @@
+require 'rails_helper'
+
+describe Api::V1::Accounts::CredentialsController do
+  render_views
+
+  let(:user)  { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
+
+  context 'with an oauth token' do
+    before do
+      allow(controller).to receive(:doorkeeper_token) { token }
+    end
+
+    describe 'GET #show' do
+      let(:scopes) { 'read:accounts' }
+
+      it 'returns http success' do
+        get :show
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    describe 'PATCH #update' do
+      let(:scopes) { 'write:accounts' }
+
+      describe 'with valid data' do
+        before do
+          allow(ActivityPub::UpdateDistributionWorker).to receive(:perform_async)
+
+          patch :update, params: {
+            display_name: "Alice Isn't Dead",
+            note: "Hi!\n\nToot toot!",
+            avatar: fixture_file_upload('files/avatar.gif', 'image/gif'),
+            header: fixture_file_upload('files/attachment.jpg', 'image/jpeg'),
+            source: {
+              privacy: 'unlisted',
+              sensitive: true,
+            }
+          }
+        end
+
+        it 'returns http success' do
+          expect(response).to have_http_status(200)
+        end
+
+        it 'updates account info' do
+          user.account.reload
+
+          expect(user.account.display_name).to eq("Alice Isn't Dead")
+          expect(user.account.note).to eq("Hi!\n\nToot toot!")
+          expect(user.account.avatar).to exist
+          expect(user.account.header).to exist
+          expect(user.setting_default_privacy).to eq('unlisted')
+          expect(user.setting_default_sensitive).to eq(true)
+        end
+
+        it 'queues up an account update distribution' do
+          expect(ActivityPub::UpdateDistributionWorker).to have_received(:perform_async).with(user.account_id)
+        end
+      end
+
+      describe 'with invalid data' do
+        before do
+          patch :update, params: { note: 'This is too long. ' * 30 }
+        end
+
+        it 'returns http unprocessable entity' do
+          expect(response).to have_http_status(:unprocessable_entity)
+        end
+      end
+    end
+  end
+
+  context 'without an oauth token' do
+    before do
+      allow(controller).to receive(:doorkeeper_token) { nil }
+    end
+
+    describe 'GET #show' do
+      it 'returns http unauthorized' do
+        get :show
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
+
+    describe 'PATCH #update' do
+      it 'returns http unauthorized' do
+        patch :update, params: { note: 'Foo' }
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
+  end
+end

spec/controllers/api/v1/accounts/follower_accounts_controller_spec.rb

@@ -0,0 +1,21 @@
+require 'rails_helper'
+
+describe Api::V1::Accounts::FollowerAccountsController do
+  render_views
+
+  let(:user)  { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read:accounts') }
+
+  before do
+    Fabricate(:follow, target_account: user.account)
+    allow(controller).to receive(:doorkeeper_token) { token }
+  end
+
+  describe 'GET #index' do
+    it 'returns http success' do
+      get :index, params: { account_id: user.account.id, limit: 1 }
+
+      expect(response).to have_http_status(200)
+    end
+  end
+end

spec/controllers/api/v1/accounts/following_accounts_controller_spec.rb

@@ -0,0 +1,21 @@
+require 'rails_helper'
+
+describe Api::V1::Accounts::FollowingAccountsController do
+  render_views
+
+  let(:user)  { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read:accounts') }
+
+  before do
+    Fabricate(:follow, account: user.account)
+    allow(controller).to receive(:doorkeeper_token) { token }
+  end
+
+  describe 'GET #index' do
+    it 'returns http success' do
+      get :index, params: { account_id: user.account.id, limit: 1 }
+
+      expect(response).to have_http_status(200)
+    end
+  end
+end

spec/controllers/api/v1/accounts/lists_controller_spec.rb

@@ -0,0 +1,23 @@
+require 'rails_helper'
+
+describe Api::V1::Accounts::ListsController do
+  render_views
+
+  let(:user)    { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:token)   { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read:lists') }
+  let(:account) { Fabricate(:account) }
+  let(:list)    { Fabricate(:list, account: user.account) }
+
+  before do
+    allow(controller).to receive(:doorkeeper_token) { token }
+    user.account.follow!(account)
+    list.accounts << account
+  end
+
+  describe 'GET #index' do
+    it 'returns http success' do
+      get :index, params: { account_id: account.id }
+      expect(response).to have_http_status(200)
+    end
+  end
+end

spec/controllers/api/v1/accounts/pins_controller_spec.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Api::V1::Accounts::PinsController, type: :controller do
+  let(:john)  { Fabricate(:user, account: Fabricate(:account, username: 'john')) }
+  let(:kevin) { Fabricate(:user, account: Fabricate(:account, username: 'kevin')) }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: john.id, scopes: 'write:accounts') }
+
+  before do
+    kevin.account.followers << john.account
+    allow(controller).to receive(:doorkeeper_token) { token }
+  end
+
+  describe 'POST #create' do
+    subject { post :create, params: { account_id: kevin.account.id } }
+
+    it 'returns 200' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'creates account_pin' do
+      expect do
+        subject
+      end.to change { AccountPin.where(account: john.account, target_account: kevin.account).count }.by(1)
+    end
+  end
+
+  describe 'DELETE #destroy' do
+    subject { delete :destroy, params: { account_id: kevin.account.id } }
+
+    before do
+      Fabricate(:account_pin, account: john.account, target_account: kevin.account)
+    end
+
+    it 'returns 200' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'destroys account_pin' do
+      expect do
+        subject
+      end.to change { AccountPin.where(account: john.account, target_account: kevin.account).count }.by(-1)
+    end
+  end
+end

spec/controllers/api/v1/accounts/relationships_controller_spec.rb

@@ -0,0 +1,93 @@
+require 'rails_helper'
+
+describe Api::V1::Accounts::RelationshipsController do
+  render_views
+
+  let(:user)  { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read:follows') }
+
+  before do
+    allow(controller).to receive(:doorkeeper_token) { token }
+  end
+
+  describe 'GET #index' do
+    let(:simon) { Fabricate(:user, email: 'simon@example.com', account: Fabricate(:account, username: 'simon')).account }
+    let(:lewis) { Fabricate(:user, email: 'lewis@example.com', account: Fabricate(:account, username: 'lewis')).account }
+
+    before do
+      user.account.follow!(simon)
+      lewis.follow!(user.account)
+    end
+
+    context 'provided only one ID' do
+      before do
+        get :index, params: { id: simon.id }
+      end
+
+      it 'returns http success' do
+        expect(response).to have_http_status(200)
+      end
+
+      it 'returns JSON with correct data' do
+        json = body_as_json
+
+        expect(json).to be_a Enumerable
+        expect(json.first[:following]).to be true
+        expect(json.first[:followed_by]).to be false
+      end
+    end
+
+    context 'provided multiple IDs' do
+      before do
+        get :index, params: { id: [simon.id, lewis.id] }
+      end
+
+      it 'returns http success' do
+        expect(response).to have_http_status(200)
+      end
+
+      it 'returns JSON with correct data' do
+        json = body_as_json
+
+        expect(json).to be_a Enumerable
+        expect(json.first[:id]).to eq simon.id.to_s
+        expect(json.first[:following]).to be true
+        expect(json.first[:showing_reblogs]).to be true
+        expect(json.first[:followed_by]).to be false
+        expect(json.first[:muting]).to be false
+        expect(json.first[:requested]).to be false
+        expect(json.first[:domain_blocking]).to be false
+
+        expect(json.second[:id]).to eq lewis.id.to_s
+        expect(json.second[:following]).to be false
+        expect(json.second[:showing_reblogs]).to be false
+        expect(json.second[:followed_by]).to be true
+        expect(json.second[:muting]).to be false
+        expect(json.second[:requested]).to be false
+        expect(json.second[:domain_blocking]).to be false
+      end
+
+      it 'returns JSON with correct data on cached requests too' do
+        get :index, params: { id: [simon.id] }
+
+        json = body_as_json
+
+        expect(json).to be_a Enumerable
+        expect(json.first[:following]).to be true
+        expect(json.first[:showing_reblogs]).to be true
+      end
+
+      it 'returns JSON with correct data after change too' do
+        user.account.unfollow!(simon)
+
+        get :index, params: { id: [simon.id] }
+
+        json = body_as_json
+
+        expect(json).to be_a Enumerable
+        expect(json.first[:following]).to be false
+        expect(json.first[:showing_reblogs]).to be false
+      end
+    end
+  end
+end

spec/controllers/api/v1/accounts/search_controller_spec.rb

@@ -0,0 +1,20 @@
+require 'rails_helper'
+
+RSpec.describe Api::V1::Accounts::SearchController, type: :controller do
+  render_views
+
+  let(:user)  { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read:accounts') }
+
+  before do
+    allow(controller).to receive(:doorkeeper_token) { token }
+  end
+
+  describe 'GET #show' do
+    it 'returns http success' do
+      get :show, params: { q: 'query' }
+
+      expect(response).to have_http_status(200)
+    end
+  end
+end

spec/controllers/api/v1/accounts/statuses_controller_spec.rb

@@ -0,0 +1,54 @@
+require 'rails_helper'
+
+describe Api::V1::Accounts::StatusesController do
+  render_views
+
+  let(:user)  { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read:statuses') }
+
+  before do
+    allow(controller).to receive(:doorkeeper_token) { token }
+    Fabricate(:status, account: user.account)
+  end
+
+  describe 'GET #index' do
+    it 'returns http success' do
+      get :index, params: { account_id: user.account.id, limit: 1 }
+
+      expect(response).to have_http_status(200)
+      expect(response.headers['Link'].links.size).to eq(2)
+    end
+
+    context 'with only media' do
+      it 'returns http success' do
+        get :index, params: { account_id: user.account.id, only_media: true }
+
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    context 'with exclude replies' do
+      before do
+        Fabricate(:status, account: user.account, thread: Fabricate(:status))
+      end
+
+      it 'returns http success' do
+        get :index, params: { account_id: user.account.id, exclude_replies: true }
+
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    context 'with only pinned' do
+      before do
+        Fabricate(:status_pin, account: user.account, status: Fabricate(:status, account: user.account))
+      end
+
+      it 'returns http success' do
+        get :index, params: { account_id: user.account.id, pinned: true }
+
+        expect(response).to have_http_status(200)
+      end
+    end
+  end
+end

spec/controllers/api/v1/accounts_controller_spec.rb

@@ -0,0 +1,260 @@
+require 'rails_helper'
+
+RSpec.describe Api::V1::AccountsController, type: :controller do
+  render_views
+
+  let(:user)   { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:scopes) { '' }
+  let(:token)  { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
+
+  before do
+    allow(controller).to receive(:doorkeeper_token) { token }
+  end
+
+  shared_examples 'forbidden for wrong scope' do |wrong_scope|
+    let(:scopes) { wrong_scope }
+
+    it 'returns http forbidden' do
+      expect(response).to have_http_status(403)
+    end
+  end
+
+  describe 'POST #create' do
+    let(:app) { Fabricate(:application) }
+    let(:token) { Doorkeeper::AccessToken.find_or_create_for(app, nil, 'read write', nil, false) }
+    let(:agreement) { nil }
+
+    before do
+      post :create, params: { username: 'test', password: '12345678', email: 'hello@world.tld', agreement: agreement }
+    end
+
+    context 'given truthy agreement' do
+      let(:agreement) { 'true' }
+
+      it 'returns http success' do
+        expect(response).to have_http_status(200)
+      end
+
+      it 'returns a new access token as JSON' do
+        expect(body_as_json[:access_token]).to_not be_blank
+      end
+
+      it 'creates a user' do
+        user = User.find_by(email: 'hello@world.tld')
+        expect(user).to_not be_nil
+        expect(user.created_by_application_id).to eq app.id
+      end
+    end
+
+    context 'given no agreement' do
+      it 'returns http unprocessable entity' do
+        expect(response).to have_http_status(422)
+      end
+    end
+  end
+
+  describe 'GET #show' do
+    let(:scopes) { 'read:accounts' }
+
+    before do
+      get :show, params: { id: user.account.id }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it_behaves_like 'forbidden for wrong scope', 'write:statuses'
+  end
+
+  describe 'POST #follow' do
+    let(:scopes) { 'write:follows' }
+    let(:other_account) { Fabricate(:user, email: 'bob@example.com', account: Fabricate(:account, username: 'bob', locked: locked)).account }
+
+    before do
+      post :follow, params: { id: other_account.id }
+    end
+
+    context 'with unlocked account' do
+      let(:locked) { false }
+
+      it 'returns http success' do
+        expect(response).to have_http_status(200)
+      end
+
+      it 'returns JSON with following=true and requested=false' do
+        json = body_as_json
+
+        expect(json[:following]).to be true
+        expect(json[:requested]).to be false
+      end
+
+      it 'creates a following relation between user and target user' do
+        expect(user.account.following?(other_account)).to be true
+      end
+
+      it_behaves_like 'forbidden for wrong scope', 'read:accounts'
+    end
+
+    context 'with locked account' do
+      let(:locked) { true }
+
+      it 'returns http success' do
+        expect(response).to have_http_status(200)
+      end
+
+      it 'returns JSON with following=false and requested=true' do
+        json = body_as_json
+
+        expect(json[:following]).to be false
+        expect(json[:requested]).to be true
+      end
+
+      it 'creates a follow request relation between user and target user' do
+        expect(user.account.requested?(other_account)).to be true
+      end
+
+      it_behaves_like 'forbidden for wrong scope', 'read:accounts'
+    end
+  end
+
+  describe 'POST #unfollow' do
+    let(:scopes) { 'write:follows' }
+    let(:other_account) { Fabricate(:user, email: 'bob@example.com', account: Fabricate(:account, username: 'bob')).account }
+
+    before do
+      user.account.follow!(other_account)
+      post :unfollow, params: { id: other_account.id }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'removes the following relation between user and target user' do
+      expect(user.account.following?(other_account)).to be false
+    end
+
+    it_behaves_like 'forbidden for wrong scope', 'read:accounts'
+  end
+
+  describe 'POST #block' do
+    let(:scopes) { 'write:blocks' }
+    let(:other_account) { Fabricate(:user, email: 'bob@example.com', account: Fabricate(:account, username: 'bob')).account }
+
+    before do
+      user.account.follow!(other_account)
+      post :block, params: { id: other_account.id }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'removes the following relation between user and target user' do
+      expect(user.account.following?(other_account)).to be false
+    end
+
+    it 'creates a blocking relation' do
+      expect(user.account.blocking?(other_account)).to be true
+    end
+
+    it_behaves_like 'forbidden for wrong scope', 'read:accounts'
+  end
+
+  describe 'POST #unblock' do
+    let(:scopes) { 'write:blocks' }
+    let(:other_account) { Fabricate(:user, email: 'bob@example.com', account: Fabricate(:account, username: 'bob')).account }
+
+    before do
+      user.account.block!(other_account)
+      post :unblock, params: { id: other_account.id }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'removes the blocking relation between user and target user' do
+      expect(user.account.blocking?(other_account)).to be false
+    end
+
+    it_behaves_like 'forbidden for wrong scope', 'read:accounts'
+  end
+
+  describe 'POST #mute' do
+    let(:scopes) { 'write:mutes' }
+    let(:other_account) { Fabricate(:user, email: 'bob@example.com', account: Fabricate(:account, username: 'bob')).account }
+
+    before do
+      user.account.follow!(other_account)
+      post :mute, params: { id: other_account.id }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'does not remove the following relation between user and target user' do
+      expect(user.account.following?(other_account)).to be true
+    end
+
+    it 'creates a muting relation' do
+      expect(user.account.muting?(other_account)).to be true
+    end
+
+    it 'mutes notifications' do
+      expect(user.account.muting_notifications?(other_account)).to be true
+    end
+
+    it_behaves_like 'forbidden for wrong scope', 'read:accounts'
+  end
+
+  describe 'POST #mute with notifications set to false' do
+    let(:scopes) { 'write:mutes' }
+    let(:other_account) { Fabricate(:user, email: 'bob@example.com', account: Fabricate(:account, username: 'bob')).account }
+
+    before do
+      user.account.follow!(other_account)
+      post :mute, params: { id: other_account.id, notifications: false }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'does not remove the following relation between user and target user' do
+      expect(user.account.following?(other_account)).to be true
+    end
+
+    it 'creates a muting relation' do
+      expect(user.account.muting?(other_account)).to be true
+    end
+
+    it 'does not mute notifications' do
+      expect(user.account.muting_notifications?(other_account)).to be false
+    end
+
+    it_behaves_like 'forbidden for wrong scope', 'read:accounts'
+  end
+
+  describe 'POST #unmute' do
+    let(:scopes) { 'write:mutes' }
+    let(:other_account) { Fabricate(:user, email: 'bob@example.com', account: Fabricate(:account, username: 'bob')).account }
+
+    before do
+      user.account.mute!(other_account)
+      post :unmute, params: { id: other_account.id }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'removes the muting relation between user and target user' do
+      expect(user.account.muting?(other_account)).to be false
+    end
+
+    it_behaves_like 'forbidden for wrong scope', 'read:accounts'
+  end
+end

spec/controllers/api/v1/apps/credentials_controller_spec.rb

@@ -0,0 +1,43 @@
+require 'rails_helper'
+
+describe Api::V1::Apps::CredentialsController do
+  render_views
+
+  let(:token) { Fabricate(:accessible_access_token, scopes: 'read', application: Fabricate(:application)) }
+
+  context 'with an oauth token' do
+    before do
+      allow(controller).to receive(:doorkeeper_token) { token }
+    end
+
+    describe 'GET #show' do
+      before do
+        get :show
+      end
+
+      it 'returns http success' do
+        expect(response).to have_http_status(200)
+      end
+
+      it 'does not contain client credentials' do
+        json = body_as_json
+
+        expect(json).to_not have_key(:client_secret)
+        expect(json).to_not have_key(:client_id)
+      end
+    end
+  end
+
+  context 'without an oauth token' do
+    before do
+      allow(controller).to receive(:doorkeeper_token) { nil }
+    end
+
+    describe 'GET #show' do
+      it 'returns http unauthorized' do
+        get :show
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
+  end
+end

spec/controllers/api/v1/apps_controller_spec.rb

@@ -0,0 +1,26 @@
+require 'rails_helper'
+
+RSpec.describe Api::V1::AppsController, type: :controller do
+  render_views
+
+  describe 'POST #create' do
+    before do
+      post :create, params: { client_name: 'Test app', redirect_uris: 'urn:ietf:wg:oauth:2.0:oob' }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'creates an OAuth app' do
+      expect(Doorkeeper::Application.find_by(name: 'Test app')).to_not be nil
+    end
+
+    it 'returns client ID and client secret' do
+      json = body_as_json
+
+      expect(json[:client_id]).to_not be_blank
+      expect(json[:client_secret]).to_not be_blank
+    end
+  end
+end

spec/controllers/api/v1/blocks_controller_spec.rb

@@ -0,0 +1,63 @@
+require 'rails_helper'
+
+RSpec.describe Api::V1::BlocksController, type: :controller do
+  render_views
+
+  let(:user)   { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:scopes) { 'read:blocks' }
+  let(:token)  { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
+
+  before { allow(controller).to receive(:doorkeeper_token) { token } }
+
+  describe 'GET #index' do
+    it 'limits according to limit parameter' do
+      2.times.map { Fabricate(:block, account: user.account) }
+      get :index, params: { limit: 1 }
+      expect(body_as_json.size).to eq 1
+    end
+
+    it 'queries blocks in range according to max_id' do
+      blocks = 2.times.map { Fabricate(:block, account: user.account) }
+
+      get :index, params: { max_id: blocks[1] }
+
+      expect(body_as_json.size).to eq 1
+      expect(body_as_json[0][:id]).to eq blocks[0].target_account_id.to_s
+    end
+
+    it 'queries blocks in range according to since_id' do
+      blocks = 2.times.map { Fabricate(:block, account: user.account) }
+
+      get :index, params: { since_id: blocks[0] }
+
+      expect(body_as_json.size).to eq 1
+      expect(body_as_json[0][:id]).to eq blocks[1].target_account_id.to_s
+    end
+
+    it 'sets pagination header for next path' do
+      blocks = 2.times.map { Fabricate(:block, account: user.account) }
+      get :index, params: { limit: 1, since_id: blocks[0] }
+      expect(response.headers['Link'].find_link(['rel', 'next']).href).to eq api_v1_blocks_url(limit: 1, max_id: blocks[1])
+    end
+
+    it 'sets pagination header for previous path' do
+      block = Fabricate(:block, account: user.account)
+      get :index
+      expect(response.headers['Link'].find_link(['rel', 'prev']).href).to eq api_v1_blocks_url(since_id: block)
+    end
+
+    it 'returns http success' do
+      get :index
+      expect(response).to have_http_status(200)
+    end
+
+    context 'with wrong scopes' do
+      let(:scopes) { 'write:blocks' }
+
+      it 'returns http forbidden' do
+        get :index
+        expect(response).to have_http_status(403)
+      end
+    end
+  end
+end

spec/controllers/api/v1/conversations_controller_spec.rb

@@ -0,0 +1,37 @@
+require 'rails_helper'
+
+RSpec.describe Api::V1::ConversationsController, type: :controller do
+  render_views
+
+  let!(:user) { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
+  let(:other) { Fabricate(:user, account: Fabricate(:account, username: 'bob')) }
+
+  before do
+    allow(controller).to receive(:doorkeeper_token) { token }
+  end
+
+  describe 'GET #index' do
+    let(:scopes) { 'read:statuses' }
+
+    before do
+      PostStatusService.new.call(other.account, text: 'Hey @alice', visibility: 'direct')
+    end
+
+    it 'returns http success' do
+      get :index
+      expect(response).to have_http_status(200)
+    end
+
+    it 'returns pagination headers' do
+      get :index, params: { limit: 1 }
+      expect(response.headers['Link'].links.size).to eq(2)
+    end
+
+    it 'returns conversations' do
+      get :index
+      json = body_as_json
+      expect(json.size).to eq 1
+    end
+  end
+end

spec/controllers/api/v1/custom_emojis_controller_spec.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Api::V1::CustomEmojisController, type: :controller do
+  render_views
+
+  describe 'GET #index' do
+    before do
+      Fabricate(:custom_emoji)
+      get :index
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+  end
+end

spec/controllers/api/v1/domain_blocks_controller_spec.rb

@@ -0,0 +1,75 @@
+require 'rails_helper'
+
+RSpec.describe Api::V1::DomainBlocksController, type: :controller do
+  render_views
+
+  let(:user)  { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
+
+  before do
+    user.account.block_domain!('example.com')
+    allow(controller).to receive(:doorkeeper_token) { token }
+  end
+
+  shared_examples 'forbidden for wrong scope' do |wrong_scope|
+    let(:scopes) { wrong_scope }
+
+    it 'returns http forbidden' do
+      expect(response).to have_http_status(403)
+    end
+  end
+
+  describe 'GET #show' do
+    let(:scopes) { 'read:blocks' }
+
+    before do
+      get :show, params: { limit: 1 }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'returns blocked domains' do
+      expect(body_as_json.first).to eq 'example.com'
+    end
+
+    it_behaves_like 'forbidden for wrong scope', 'write:statuses'
+  end
+
+  describe 'POST #create' do
+    let(:scopes) { 'write:blocks' }
+
+    before do
+      post :create, params: { domain: 'example.org' }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'creates a domain block' do
+      expect(user.account.domain_blocking?('example.org')).to be true
+    end
+
+    it_behaves_like 'forbidden for wrong scope', 'write:statuses'
+  end
+
+  describe 'DELETE #destroy' do
+    let(:scopes) { 'write:blocks' }
+
+    before do
+      delete :destroy, params: { domain: 'example.com' }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'deletes a domain block' do
+      expect(user.account.domain_blocking?('example.com')).to be false
+    end
+
+    it_behaves_like 'forbidden for wrong scope', 'write:statuses'
+  end
+end

spec/controllers/api/v1/endorsements_controller_spec.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Api::V1::EndorsementsController, type: :controller do
+  let(:user)  { Fabricate(:user) }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read:accounts') }
+
+  describe 'GET #index' do
+    it 'returns 200' do
+      allow(controller).to receive(:doorkeeper_token) { token }
+      get :index
+
+      expect(response).to have_http_status(200)
+    end
+  end
+end

spec/controllers/api/v1/favourites_controller_spec.rb

@@ -0,0 +1,78 @@
+require 'rails_helper'
+
+RSpec.describe Api::V1::FavouritesController, type: :controller do
+  render_views
+
+  let(:user)  { Fabricate(:user) }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read') }
+
+  describe 'GET #index' do
+    context 'without token' do
+      it 'returns http unauthorized' do
+        get :index
+        expect(response).to have_http_status :unauthorized
+      end
+    end
+
+    context 'with token' do
+      context 'without read scope' do
+        before do
+          allow(controller).to receive(:doorkeeper_token) do
+            Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: '')
+          end
+        end
+
+        it 'returns http forbidden' do
+          get :index
+          expect(response).to have_http_status :forbidden
+        end
+      end
+
+      context 'without valid resource owner' do
+        before do
+          token = Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read')
+          user.destroy!
+
+          allow(controller).to receive(:doorkeeper_token) { token }
+        end
+
+        it 'returns http unprocessable entity' do
+          get :index
+          expect(response).to have_http_status :unprocessable_entity
+        end
+      end
+
+      context 'with read scope and valid resource owner' do
+        before do
+          allow(controller).to receive(:doorkeeper_token) do
+            Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read:favourites')
+          end
+        end
+
+        it 'shows favourites owned by the user' do
+          favourite_by_user = Fabricate(:favourite, account: user.account)
+          favourite_by_others = Fabricate(:favourite)
+
+          get :index
+
+          expect(assigns(:statuses)).to match_array [favourite_by_user.status]
+        end
+
+        it 'adds pagination headers if necessary' do
+          favourite = Fabricate(:favourite, account: user.account)
+
+          get :index, params: { limit: 1 }
+
+          expect(response.headers['Link'].find_link(['rel', 'next']).href).to eq "http://test.host/api/v1/favourites?limit=1&max_id=#{favourite.id}"
+          expect(response.headers['Link'].find_link(['rel', 'prev']).href).to eq "http://test.host/api/v1/favourites?limit=1&min_id=#{favourite.id}"
+        end
+
+        it 'does not add pagination headers if not necessary' do
+          get :index
+
+          expect(response.headers['Link']).to eq nil
+        end
+      end
+    end
+  end
+end

spec/controllers/api/v1/filters_controller_spec.rb

@@ -0,0 +1,87 @@
+require 'rails_helper'
+
+RSpec.describe Api::V1::FiltersController, type: :controller do
+  render_views
+
+  let(:user)  { Fabricate(:user) }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
+
+  before do
+    allow(controller).to receive(:doorkeeper_token) { token }
+  end
+
+  describe 'GET #index' do
+    let(:scopes) { 'read:filters' }
+    let!(:filter) { Fabricate(:custom_filter, account: user.account) }
+
+    it 'returns http success' do
+      get :index
+      expect(response).to have_http_status(200)
+    end
+  end
+
+  describe 'POST #create' do
+    let(:scopes) { 'write:filters' }
+
+    before do
+      post :create, params: { phrase: 'magic', context: %w(home), irreversible: true }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'creates a filter' do
+      filter = user.account.custom_filters.first
+      expect(filter).to_not be_nil
+      expect(filter.phrase).to eq 'magic'
+      expect(filter.context).to eq %w(home)
+      expect(filter.irreversible?).to be true
+      expect(filter.expires_at).to be_nil
+    end
+  end
+
+  describe 'GET #show' do
+    let(:scopes) { 'read:filters' }
+    let(:filter) { Fabricate(:custom_filter, account: user.account) }
+
+    it 'returns http success' do
+      get :show, params: { id: filter.id }
+      expect(response).to have_http_status(200)
+    end
+  end
+
+  describe 'PUT #update' do
+    let(:scopes) { 'write:filters' }
+    let(:filter) { Fabricate(:custom_filter, account: user.account) }
+
+    before do
+      put :update, params: { id: filter.id, phrase: 'updated' }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'updates the filter' do
+      expect(filter.reload.phrase).to eq 'updated'
+    end
+  end
+
+  describe 'DELETE #destroy' do
+    let(:scopes) { 'write:filters' }
+    let(:filter) { Fabricate(:custom_filter, account: user.account) }
+
+    before do
+      delete :destroy, params: { id: filter.id }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'removes the filter' do
+      expect { filter.reload }.to raise_error ActiveRecord::RecordNotFound
+    end
+  end
+end

spec/controllers/api/v1/follow_requests_controller_spec.rb

@@ -0,0 +1,58 @@
+require 'rails_helper'
+
+RSpec.describe Api::V1::FollowRequestsController, type: :controller do
+  render_views
+
+  let(:user)     { Fabricate(:user, account: Fabricate(:account, username: 'alice', locked: true)) }
+  let(:token)    { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
+  let(:follower) { Fabricate(:account, username: 'bob') }
+
+  before do
+    FollowService.new.call(follower, user.account.acct)
+    allow(controller).to receive(:doorkeeper_token) { token }
+  end
+
+  describe 'GET #index' do
+    let(:scopes) { 'read:follows' }
+
+    before do
+      get :index, params: { limit: 1 }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+  end
+
+  describe 'POST #authorize' do
+    let(:scopes) { 'write:follows' }
+
+    before do
+      post :authorize, params: { id: follower.id }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'allows follower to follow' do
+      expect(follower.following?(user.account)).to be true
+    end
+  end
+
+  describe 'POST #reject' do
+    let(:scopes) { 'write:follows' }
+
+    before do
+      post :reject, params: { id: follower.id }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'removes follow request' do
+      expect(FollowRequest.where(target_account: user.account, account: follower).count).to eq 0
+    end
+  end
+end

spec/controllers/api/v1/follows_controller_spec.rb

@@ -0,0 +1,51 @@
+require 'rails_helper'
+
+RSpec.describe Api::V1::FollowsController, type: :controller do
+  render_views
+
+  let(:user)  { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'write:follows') }
+
+  before do
+    allow(controller).to receive(:doorkeeper_token) { token }
+  end
+
+  describe 'POST #create' do
+    before do
+      stub_request(:get,  "https://quitter.no/.well-known/host-meta").to_return(request_fixture('.host-meta.txt'))
+      stub_request(:get,  "https://quitter.no/.well-known/webfinger?resource=acct:robcolbert@quitter.no").to_return(request_fixture('webfinger.txt'))
+      stub_request(:head, "https://quitter.no/api/statuses/user_timeline/7477.atom").to_return(:status => 405, :body => "", :headers => {})
+      stub_request(:get,  "https://quitter.no/api/statuses/user_timeline/7477.atom").to_return(request_fixture('feed.txt'))
+      stub_request(:get,  "https://quitter.no/avatar/7477-300-20160211190340.png").to_return(request_fixture('avatar.txt'))
+      stub_request(:post, "https://quitter.no/main/push/hub").to_return(:status => 200, :body => "", :headers => {})
+      stub_request(:post, "https://quitter.no/main/salmon/user/7477").to_return(:status => 200, :body => "", :headers => {})
+
+      post :create, params: { uri: 'robcolbert@quitter.no' }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'creates account for remote user' do
+      expect(Account.find_by(username: 'robcolbert', domain: 'quitter.no')).to_not be_nil
+    end
+
+    it 'creates a follow relation between user and remote user' do
+      expect(user.account.following?(Account.find_by(username: 'robcolbert', domain: 'quitter.no'))).to be true
+    end
+
+    it 'sends a salmon slap to the remote user' do
+      expect(a_request(:post, "https://quitter.no/main/salmon/user/7477")).to have_been_made
+    end
+
+    it 'subscribes to remote hub' do
+      expect(a_request(:post, "https://quitter.no/main/push/hub")).to have_been_made
+    end
+
+    it 'returns http success if already following, too' do
+      post :create, params: { uri: 'robcolbert@quitter.no' }
+      expect(response).to have_http_status(200)
+    end
+  end
+end

spec/controllers/api/v1/instances/activity_controller_spec.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Api::V1::Instances::ActivityController, type: :controller do
+  describe 'GET #show' do
+    it 'returns 200' do
+      get :show
+      expect(response).to have_http_status(200)
+    end
+
+    context '!Setting.activity_api_enabled' do
+      it 'returns 404' do
+        Setting.activity_api_enabled = false
+
+        get :show
+        expect(response).to have_http_status(404)
+      end
+    end
+  end
+end

spec/controllers/api/v1/instances/peers_controller_spec.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Api::V1::Instances::PeersController, type: :controller do
+  describe 'GET #index' do
+    it 'returns 200' do
+      get :index
+      expect(response).to have_http_status(200)
+    end
+
+    context '!Setting.peers_api_enabled' do
+      it 'returns 404' do
+        Setting.peers_api_enabled = false
+
+        get :index
+        expect(response).to have_http_status(404)
+      end
+    end
+  end
+end

spec/controllers/api/v1/instances_controller_spec.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Api::V1::InstancesController, type: :controller do
+  render_views
+
+  let(:user)  { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id) }
+
+  before do
+    allow(controller).to receive(:doorkeeper_token) { token }
+  end
+
+  describe 'GET #show' do
+    it 'returns http success' do
+      get :show
+
+      expect(response).to have_http_status(200)
+    end
+  end
+end

spec/controllers/api/v1/lists/accounts_controller_spec.rb

@@ -0,0 +1,59 @@
+require 'rails_helper'
+
+describe Api::V1::Lists::AccountsController do
+  render_views
+
+  let(:user)  { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
+  let(:list)  { Fabricate(:list, account: user.account) }
+
+  before do
+    follow = Fabricate(:follow, account: user.account)
+    list.accounts << follow.target_account
+    allow(controller).to receive(:doorkeeper_token) { token }
+  end
+
+  describe 'GET #index' do
+    let(:scopes) { 'read:lists' }
+
+    it 'returns http success' do
+      get :show, params: { list_id: list.id }
+
+      expect(response).to have_http_status(200)
+    end
+  end
+
+  describe 'POST #create' do
+    let(:scopes) { 'write:lists' }
+    let(:bob) { Fabricate(:account, username: 'bob') }
+
+    before do
+      user.account.follow!(bob)
+      post :create, params: { list_id: list.id, account_ids: [bob.id] }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'adds account to the list' do
+      expect(list.accounts.include?(bob)).to be true
+    end
+  end
+
+  describe 'DELETE #destroy' do
+    let(:scopes) { 'write:lists' }
+
+    before do
+      delete :destroy, params: { list_id: list.id, account_ids: [list.accounts.first.id] }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'removes account from the list' do
+      expect(list.accounts.count).to eq 0
+    end
+  end
+end

spec/controllers/api/v1/lists_controller_spec.rb

@@ -0,0 +1,78 @@
+require 'rails_helper'
+
+RSpec.describe Api::V1::ListsController, type: :controller do
+  render_views
+
+  let!(:user)  { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let!(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
+  let!(:list)  { Fabricate(:list, account: user.account) }
+
+  before { allow(controller).to receive(:doorkeeper_token) { token } }
+
+  describe 'GET #index' do
+    let(:scopes) { 'read:lists' }
+
+    it 'returns http success' do
+      get :index
+      expect(response).to have_http_status(200)
+    end
+  end
+
+  describe 'GET #show' do
+    let(:scopes) { 'read:lists' }
+
+    it 'returns http success' do
+      get :show, params: { id: list.id }
+      expect(response).to have_http_status(200)
+    end
+  end
+
+  describe 'POST #create' do
+    let(:scopes) { 'write:lists' }
+
+    before do
+      post :create, params: { title: 'Foo bar' }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'creates list' do
+      expect(List.where(account: user.account).count).to eq 2
+      expect(List.last.title).to eq 'Foo bar'
+    end
+  end
+
+  describe 'PUT #update' do
+    let(:scopes) { 'write:lists' }
+
+    before do
+      put :update, params: { id: list.id, title: 'Updated title' }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'updates the list' do
+      expect(list.reload.title).to eq 'Updated title'
+    end
+  end
+
+  describe 'DELETE #destroy' do
+    let(:scopes) { 'write:lists' }
+
+    before do
+      delete :destroy, params: { id: list.id }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'deletes the list' do
+      expect(List.find_by(id: list.id)).to be_nil
+    end
+  end
+end

spec/controllers/api/v1/media_controller_spec.rb

@@ -0,0 +1,131 @@
+require 'rails_helper'
+
+RSpec.describe Api::V1::MediaController, type: :controller do
+  render_views
+
+  let(:user)  { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'write:media') }
+
+  before do
+    allow(controller).to receive(:doorkeeper_token) { token }
+  end
+
+  describe 'POST #create' do
+    describe 'with paperclip errors' do
+      context 'when imagemagick cant identify the file type' do
+        before do
+          expect_any_instance_of(Account).to receive_message_chain(:media_attachments, :create!).and_raise(Paperclip::Errors::NotIdentifiedByImageMagickError)
+          post :create, params: { file: fixture_file_upload('files/attachment.jpg', 'image/jpeg') }
+        end
+
+        it 'returns http 422' do
+          expect(response).to have_http_status(:unprocessable_entity)
+        end
+      end
+
+      context 'when there is a generic error' do
+        before do
+          expect_any_instance_of(Account).to receive_message_chain(:media_attachments, :create!).and_raise(Paperclip::Error)
+          post :create, params: { file: fixture_file_upload('files/attachment.jpg', 'image/jpeg') }
+        end
+
+        it 'returns http 422' do
+          expect(response).to have_http_status(500)
+        end
+      end
+    end
+
+    context 'image/jpeg' do
+      before do
+        post :create, params: { file: fixture_file_upload('files/attachment.jpg', 'image/jpeg') }
+      end
+
+      it 'returns http success' do
+        expect(response).to have_http_status(200)
+      end
+
+      it 'creates a media attachment' do
+        expect(MediaAttachment.first).to_not be_nil
+      end
+
+      it 'uploads a file' do
+        expect(MediaAttachment.first).to have_attached_file(:file)
+      end
+
+      it 'returns media ID in JSON' do
+        expect(body_as_json[:id]).to eq MediaAttachment.first.id.to_s
+      end
+    end
+
+    context 'image/gif' do
+      before do
+        post :create, params: { file: fixture_file_upload('files/attachment.gif', 'image/gif') }
+      end
+
+      it 'returns http success' do
+        expect(response).to have_http_status(200)
+      end
+
+      it 'creates a media attachment' do
+        expect(MediaAttachment.first).to_not be_nil
+      end
+
+      it 'uploads a file' do
+        expect(MediaAttachment.first).to have_attached_file(:file)
+      end
+
+      it 'returns media ID in JSON' do
+        expect(body_as_json[:id]).to eq MediaAttachment.first.id.to_s
+      end
+    end
+
+    context 'video/webm' do
+      before do
+        post :create, params: { file: fixture_file_upload('files/attachment.webm', 'video/webm') }
+      end
+
+      it do
+        # returns http success
+        expect(response).to have_http_status(200)
+
+        # creates a media attachment
+        expect(MediaAttachment.first).to_not be_nil
+
+        # uploads a file
+        expect(MediaAttachment.first).to have_attached_file(:file)
+
+        # returns media ID in JSON
+        expect(body_as_json[:id]).to eq MediaAttachment.first.id.to_s
+      end
+    end
+  end
+
+  describe 'PUT #update' do
+    context 'when somebody else\'s' do
+      let(:media) { Fabricate(:media_attachment, status: nil) }
+
+      it 'returns http not found' do
+        put :update, params: { id: media.id, description: 'Lorem ipsum!!!' }
+        expect(response).to have_http_status(:not_found)
+      end
+    end
+
+    context 'when not attached to a status' do
+      let(:media) { Fabricate(:media_attachment, status: nil, account: user.account) }
+
+      it 'updates the description' do
+        put :update, params: { id: media.id, description: 'Lorem ipsum!!!' }
+        expect(media.reload.description).to eq 'Lorem ipsum!!!'
+      end
+    end
+
+    context 'when attached to a status' do
+      let(:media) { Fabricate(:media_attachment, status: Fabricate(:status), account: user.account) }
+
+      it 'returns http not found' do
+        put :update, params: { id: media.id, description: 'Lorem ipsum!!!' }
+        expect(response).to have_http_status(:not_found)
+      end
+    end
+  end
+end

spec/controllers/api/v1/mutes_controller_spec.rb

@@ -0,0 +1,63 @@
+require 'rails_helper'
+
+RSpec.describe Api::V1::MutesController, type: :controller do
+  render_views
+
+  let(:user)   { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:scopes) { 'read:mutes' }
+  let(:token)  { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
+
+  before { allow(controller).to receive(:doorkeeper_token) { token } }
+
+  describe 'GET #index' do
+    it 'limits according to limit parameter' do
+      2.times.map { Fabricate(:mute, account: user.account) }
+      get :index, params: { limit: 1 }
+      expect(body_as_json.size).to eq 1
+    end
+
+    it 'queries mutes in range according to max_id' do
+      mutes = 2.times.map { Fabricate(:mute, account: user.account) }
+
+      get :index, params: { max_id: mutes[1] }
+
+      expect(body_as_json.size).to eq 1
+      expect(body_as_json[0][:id]).to eq mutes[0].target_account_id.to_s
+    end
+
+    it 'queries mutes in range according to since_id' do
+      mutes = 2.times.map { Fabricate(:mute, account: user.account) }
+
+      get :index, params: { since_id: mutes[0] }
+
+      expect(body_as_json.size).to eq 1
+      expect(body_as_json[0][:id]).to eq mutes[1].target_account_id.to_s
+    end
+
+    it 'sets pagination header for next path' do
+      mutes = 2.times.map { Fabricate(:mute, account: user.account) }
+      get :index, params: { limit: 1, since_id: mutes[0] }
+      expect(response.headers['Link'].find_link(['rel', 'next']).href).to eq api_v1_mutes_url(limit: 1, max_id: mutes[1])
+    end
+
+    it 'sets pagination header for previous path' do
+      mute = Fabricate(:mute, account: user.account)
+      get :index
+      expect(response.headers['Link'].find_link(['rel', 'prev']).href).to eq api_v1_mutes_url(since_id: mute)
+    end
+
+    it 'returns http success' do
+      get :index
+      expect(response).to have_http_status(200)
+    end
+
+    context 'with wrong scopes' do
+      let(:scopes) { 'write:mutes' }
+
+      it 'returns http forbidden' do
+        get :index
+        expect(response).to have_http_status(403)
+      end
+    end
+  end
+end

spec/controllers/api/v1/notifications_controller_spec.rb

@@ -0,0 +1,179 @@
+require 'rails_helper'
+
+RSpec.describe Api::V1::NotificationsController, type: :controller do
+  render_views
+
+  let(:user)  { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
+  let(:other) { Fabricate(:user, account: Fabricate(:account, username: 'bob')) }
+  let(:third) { Fabricate(:user, account: Fabricate(:account, username: 'carol')) }
+
+  before do
+    allow(controller).to receive(:doorkeeper_token) { token }
+  end
+
+  describe 'GET #show' do
+    let(:scopes) { 'read:notifications' }
+
+    it 'returns http success' do
+      notification = Fabricate(:notification, account: user.account)
+      get :show, params: { id: notification.id }
+
+      expect(response).to have_http_status(200)
+    end
+  end
+
+  describe 'POST #dismiss' do
+    let(:scopes) { 'write:notifications' }
+
+    it 'destroys the notification' do
+      notification = Fabricate(:notification, account: user.account)
+      post :dismiss, params: { id: notification.id }
+
+      expect(response).to have_http_status(200)
+      expect { notification.reload }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
+
+  describe 'POST #clear' do
+    let(:scopes) { 'write:notifications' }
+
+    it 'clears notifications for the account' do
+      notification = Fabricate(:notification, account: user.account)
+      post :clear
+
+      expect(notification.account.reload.notifications).to be_empty
+      expect(response).to have_http_status(200)
+    end
+  end
+
+  describe 'GET #index' do
+    let(:scopes) { 'read:notifications' }
+
+    before do
+      first_status = PostStatusService.new.call(user.account, text: 'Test')
+      @reblog_of_first_status = ReblogService.new.call(other.account, first_status)
+      mentioning_status = PostStatusService.new.call(other.account, text: 'Hello @alice')
+      @mention_from_status = mentioning_status.mentions.first
+      @favourite = FavouriteService.new.call(other.account, first_status)
+      @second_favourite = FavouriteService.new.call(third.account, first_status)
+      @follow = FollowService.new.call(other.account, 'alice')
+    end
+
+    describe 'with no options' do
+      before do
+        get :index
+      end
+
+      it 'returns http success' do
+        expect(response).to have_http_status(200)
+      end
+
+      it 'includes reblog' do
+        expect(assigns(:notifications).map(&:activity)).to include(@reblog_of_first_status)
+      end
+
+      it 'includes mention' do
+        expect(assigns(:notifications).map(&:activity)).to include(@mention_from_status)
+      end
+
+      it 'includes favourite' do
+        expect(assigns(:notifications).map(&:activity)).to include(@favourite)
+      end
+
+      it 'includes follow' do
+        expect(assigns(:notifications).map(&:activity)).to include(@follow)
+      end
+    end
+
+    describe 'from specified user' do
+      before do
+        get :index, params: { account_id: third.account.id }
+      end
+
+      it 'returns http success' do
+        expect(response).to have_http_status(200)
+      end
+
+      it 'includes favourite' do
+        expect(assigns(:notifications).map(&:activity)).to include(@second_favourite)
+      end
+
+      it 'excludes favourite' do
+        expect(assigns(:notifications).map(&:activity)).to_not include(@favourite)
+      end
+
+      it 'excludes mention' do
+        expect(assigns(:notifications).map(&:activity)).to_not include(@mention_from_status)
+      end
+
+      it 'excludes reblog' do
+        expect(assigns(:notifications).map(&:activity)).to_not include(@reblog_of_first_status)
+      end
+
+      it 'excludes follow' do
+        expect(assigns(:notifications).map(&:activity)).to_not include(@follow)
+      end
+    end
+
+    describe 'from nonexistent user' do
+      before do
+        get :index, params: { account_id: 'foo' }
+      end
+
+      it 'returns http success' do
+        expect(response).to have_http_status(200)
+      end
+
+      it 'excludes favourite' do
+        expect(assigns(:notifications).map(&:activity)).to_not include(@favourite)
+      end
+
+      it 'excludes second favourite' do
+        expect(assigns(:notifications).map(&:activity)).to_not include(@second_favourite)
+      end
+
+      it 'excludes mention' do
+        expect(assigns(:notifications).map(&:activity)).to_not include(@mention_from_status)
+      end
+
+      it 'excludes reblog' do
+        expect(assigns(:notifications).map(&:activity)).to_not include(@reblog_of_first_status)
+      end
+
+      it 'excludes follow' do
+        expect(assigns(:notifications).map(&:activity)).to_not include(@follow)
+      end
+    end
+
+    describe 'with excluded mentions' do
+      before do
+        get :index, params: { exclude_types: ['mention'] }
+      end
+
+      it 'returns http success' do
+        expect(response).to have_http_status(200)
+      end
+
+      it 'includes reblog' do
+        expect(assigns(:notifications).map(&:activity)).to include(@reblog_of_first_status)
+      end
+
+      it 'excludes mention' do
+        expect(assigns(:notifications).map(&:activity)).to_not include(@mention_from_status)
+      end
+
+      it 'includes favourite' do
+        expect(assigns(:notifications).map(&:activity)).to include(@favourite)
+      end
+
+      it 'includes third favourite' do
+        expect(assigns(:notifications).map(&:activity)).to include(@second_favourite)
+      end
+
+      it 'includes follow' do
+        expect(assigns(:notifications).map(&:activity)).to include(@follow)
+      end
+    end
+  end
+end

spec/controllers/api/v1/polls/votes_controller_spec.rb

@@ -0,0 +1,34 @@
+require 'rails_helper'
+
+RSpec.describe Api::V1::Polls::VotesController, type: :controller do
+  render_views
+
+  let(:user)   { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:scopes) { 'write:statuses' }
+  let(:token)  { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
+
+  before { allow(controller).to receive(:doorkeeper_token) { token } }
+
+  describe 'POST #create' do
+    let(:poll) { Fabricate(:poll) }
+
+    before do
+      post :create, params: { poll_id: poll.id, choices: %w(1) }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'creates a vote' do
+      vote = poll.votes.where(account: user.account).first
+
+      expect(vote).to_not be_nil
+      expect(vote.choice).to eq 1
+    end
+
+    it 'updates poll tallies' do
+      expect(poll.reload.cached_tallies).to eq [0, 1]
+    end
+  end
+end

spec/controllers/api/v1/polls_controller_spec.rb

@@ -0,0 +1,23 @@
+require 'rails_helper'
+
+RSpec.describe Api::V1::PollsController, type: :controller do
+  render_views
+
+  let(:user)   { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:scopes) { 'read:statuses' }
+  let(:token)  { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
+
+  before { allow(controller).to receive(:doorkeeper_token) { token } }
+
+  describe 'GET #show' do
+    let(:poll) { Fabricate(:poll) }
+
+    before do
+      get :show, params: { id: poll.id }
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+  end
+end

spec/controllers/api/v1/push/subscriptions_controller_spec.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe Api::V1::Push::SubscriptionsController do
+  render_views
+
+  let(:user)  { Fabricate(:user) }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'push') }
+
+  before do
+    allow(controller).to receive(:doorkeeper_token) { token }
+  end
+
+  let(:create_payload) do
+    {
+      subscription: {
+        endpoint: 'https://fcm.googleapis.com/fcm/send/fiuH06a27qE:APA91bHnSiGcLwdaxdyqVXNDR9w1NlztsHb6lyt5WDKOC_Z_Q8BlFxQoR8tWFSXUIDdkyw0EdvxTu63iqamSaqVSevW5LfoFwojws8XYDXv_NRRLH6vo2CdgiN4jgHv5VLt2A8ah6lUX',
+        keys: {
+          p256dh: 'BEm_a0bdPDhf0SOsrnB2-ategf1hHoCnpXgQsFj5JCkcoMrMt2WHoPfEYOYPzOIs9mZE8ZUaD7VA5vouy0kEkr8=',
+          auth: 'eH_C8rq2raXqlcBVDa1gLg==',
+        },
+      }
+    }.with_indifferent_access
+  end
+
+  let(:alerts_payload) do
+    {
+      data: {
+        alerts: {
+          follow: true,
+          favourite: false,
+          reblog: true,
+          mention: false,
+        }
+      }
+    }.with_indifferent_access
+  end
+
+  describe 'POST #create' do
+    it 'saves push subscriptions' do
+      post :create, params: create_payload
+
+      push_subscription = Web::PushSubscription.find_by(endpoint: create_payload[:subscription][:endpoint])
+
+      expect(push_subscription.endpoint).to eq(create_payload[:subscription][:endpoint])
+      expect(push_subscription.key_p256dh).to eq(create_payload[:subscription][:keys][:p256dh])
+      expect(push_subscription.key_auth).to eq(create_payload[:subscription][:keys][:auth])
+      expect(push_subscription.user_id).to eq user.id
+      expect(push_subscription.access_token_id).to eq token.id
+    end
+
+    it 'replaces old subscription on repeat calls' do
+      post :create, params: create_payload
+      post :create, params: create_payload
+
+      expect(Web::PushSubscription.where(endpoint: create_payload[:subscription][:endpoint]).count).to eq 1
+    end
+  end
+
+  describe 'PUT #update' do
+    it 'changes alert settings' do
+      post :create, params: create_payload
+      put :update, params: alerts_payload
+
+      push_subscription = Web::PushSubscription.find_by(endpoint: create_payload[:subscription][:endpoint])
+
+      expect(push_subscription.data.dig('alerts', 'follow')).to eq(alerts_payload[:data][:alerts][:follow].to_s)
+      expect(push_subscription.data.dig('alerts', 'favourite')).to eq(alerts_payload[:data][:alerts][:favourite].to_s)
+      expect(push_subscription.data.dig('alerts', 'reblog')).to eq(alerts_payload[:data][:alerts][:reblog].to_s)
+      expect(push_subscription.data.dig('alerts', 'mention')).to eq(alerts_payload[:data][:alerts][:mention].to_s)
+    end
+  end
+
+  describe 'DELETE #destroy' do
+    it 'removes the subscription' do
+      post :create, params: create_payload
+      delete :destroy
+
+      expect(Web::PushSubscription.find_by(endpoint: create_payload[:subscription][:endpoint])).to be_nil
+    end
+  end
+end

spec/controllers/api/v1/reports_controller_spec.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Api::V1::ReportsController, type: :controller do
+  render_views
+
+  let(:user)  { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
+
+  before do
+    allow(controller).to receive(:doorkeeper_token) { token }
+  end
+
+  describe 'POST #create' do
+    let(:scopes)  { 'write:reports' }
+    let!(:status) { Fabricate(:status) }
+    let!(:admin)  { Fabricate(:user, admin: true) }
+
+    before do
+      allow(AdminMailer).to receive(:new_report).and_return(double('email', deliver_later: nil))
+      post :create, params: { status_ids: [status.id], account_id: status.account.id, comment: 'reasons' }
+    end
+
+    it 'creates a report' do
+      expect(status.reload.account.targeted_reports).not_to be_empty
+      expect(response).to have_http_status(200)
+    end
+
+    it 'sends e-mails to admins' do
+      expect(AdminMailer).to have_received(:new_report).with(admin.account, Report)
+    end
+  end
+end

spec/controllers/api/v1/search_controller_spec.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Api::V1::SearchController, type: :controller do
+  render_views
+
+  let(:user)  { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read:search') }
+
+  before do
+    allow(controller).to receive(:doorkeeper_token) { token }
+  end
+
+  describe 'GET #index' do
+    it 'returns http success' do
+      get :index, params: { q: 'test' }
+
+      expect(response).to have_http_status(200)
+    end
+  end
+end

spec/controllers/api/v1/statuses/favourited_by_accounts_controller_spec.rb

@@ -0,0 +1,65 @@
+require 'rails_helper'
+
+RSpec.describe Api::V1::Statuses::FavouritedByAccountsController, type: :controller do
+  render_views
+
+  let(:user)  { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:app)   { Fabricate(:application, name: 'Test app', website: 'http://testapp.com') }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, application: app, scopes: 'read:accounts') }
+
+  context 'with an oauth token' do
+    before do
+      allow(controller).to receive(:doorkeeper_token) { token }
+    end
+
+    describe 'GET #index' do
+      let(:status) { Fabricate(:status, account: user.account) }
+
+      before do
+        Fabricate(:favourite, status: status)
+      end
+
+      it 'returns http success' do
+        get :index, params: { status_id: status.id, limit: 1 }
+        expect(response).to have_http_status(200)
+        expect(response.headers['Link'].links.size).to eq(2)
+      end
+    end
+  end
+
+  context 'without an oauth token' do
+    before do
+      allow(controller).to receive(:doorkeeper_token) { nil }
+    end
+
+    context 'with a private status' do
+      let(:status) { Fabricate(:status, account: user.account, visibility: :private) }
+
+      describe 'GET #index' do
+        before do
+          Fabricate(:favourite, status: status)
+        end
+
+        it 'returns http unautharized' do
+          get :index, params: { status_id: status.id }
+          expect(response).to have_http_status(404)
+        end
+      end
+    end
+
+    context 'with a public status' do
+      let(:status) { Fabricate(:status, account: user.account, visibility: :public) }
+
+      describe 'GET #index' do
+        before do
+          Fabricate(:favourite, status: status)
+        end
+
+        it 'returns http success' do
+          get :index, params: { status_id: status.id }
+          expect(response).to have_http_status(200)
+        end
+      end
+    end
+  end
+end

spec/controllers/api/v1/statuses/favourites_controller_spec.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe Api::V1::Statuses::FavouritesController do
+  render_views
+
+  let(:user)  { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:app)   { Fabricate(:application, name: 'Test app', website: 'http://testapp.com') }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'write:favourites', application: app) }
+
+  context 'with an oauth token' do
+    before do
+      allow(controller).to receive(:doorkeeper_token) { token }
+    end
+
+    describe 'POST #create' do
+      let(:status) { Fabricate(:status, account: user.account) }
+
+      before do
+        post :create, params: { status_id: status.id }
+      end
+
+      it 'returns http success' do
+        expect(response).to have_http_status(200)
+      end
+
+      it 'updates the favourites count' do
+        expect(status.favourites.count).to eq 1
+      end
+
+      it 'updates the favourited attribute' do
+        expect(user.account.favourited?(status)).to be true
+      end
+
+      it 'return json with updated attributes' do
+        hash_body = body_as_json
+
+        expect(hash_body[:id]).to eq status.id.to_s
+        expect(hash_body[:favourites_count]).to eq 1
+        expect(hash_body[:favourited]).to be true
+      end
+    end
+
+    describe 'POST #destroy' do
+      let(:status) { Fabricate(:status, account: user.account) }
+
+      before do
+        FavouriteService.new.call(user.account, status)
+        post :destroy, params: { status_id: status.id }
+      end
+
+      it 'returns http success' do
+        expect(response).to have_http_status(200)
+      end
+
+      it 'updates the favourites count' do
+        expect(status.favourites.count).to eq 0
+      end
+
+      it 'updates the favourited attribute' do
+        expect(user.account.favourited?(status)).to be false
+      end
+    end
+  end
+end

spec/controllers/api/v1/statuses/mutes_controller_spec.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe Api::V1::Statuses::MutesController do
+  render_views
+
+  let(:user)  { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:app)   { Fabricate(:application, name: 'Test app', website: 'http://testapp.com') }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'write:mutes', application: app) }
+
+  context 'with an oauth token' do
+    before do
+      allow(controller).to receive(:doorkeeper_token) { token }
+    end
+
+    describe 'POST #create' do
+      let(:status) { Fabricate(:status, account: user.account) }
+
+      before do
+        post :create, params: { status_id: status.id }
+      end
+
+      it 'returns http success' do
+        expect(response).to have_http_status(200)
+      end
+
+      it 'creates a conversation mute' do
+        expect(ConversationMute.find_by(account: user.account, conversation_id: status.conversation_id)).to_not be_nil
+      end
+    end
+
+    describe 'POST #destroy' do
+      let(:status) { Fabricate(:status, account: user.account) }
+
+      before do
+        user.account.mute_conversation!(status.conversation)
+        post :destroy, params: { status_id: status.id }
+      end
+
+      it 'returns http success' do
+        expect(response).to have_http_status(200)
+      end
+
+      it 'destroys the conversation mute' do
+        expect(ConversationMute.find_by(account: user.account, conversation_id: status.conversation_id)).to be_nil
+      end
+    end
+  end
+end

spec/controllers/api/v1/statuses/pins_controller_spec.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe Api::V1::Statuses::PinsController do
+  render_views
+
+  let(:user)  { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:app)   { Fabricate(:application, name: 'Test app', website: 'http://testapp.com') }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'write:accounts', application: app) }
+
+  context 'with an oauth token' do
+    before do
+      allow(controller).to receive(:doorkeeper_token) { token }
+    end
+
+    describe 'POST #create' do
+      let(:status) { Fabricate(:status, account: user.account) }
+
+      before do
+        post :create, params: { status_id: status.id }
+      end
+
+      it 'returns http success' do
+        expect(response).to have_http_status(200)
+      end
+
+      it 'updates the pinned attribute' do
+        expect(user.account.pinned?(status)).to be true
+      end
+
+      it 'return json with updated attributes' do
+        hash_body = body_as_json
+
+        expect(hash_body[:id]).to eq status.id.to_s
+        expect(hash_body[:pinned]).to be true
+      end
+    end
+
+    describe 'POST #destroy' do
+      let(:status) { Fabricate(:status, account: user.account) }
+
+      before do
+        Fabricate(:status_pin, status: status, account: user.account)
+        post :destroy, params: { status_id: status.id }
+      end
+
+      it 'returns http success' do
+        expect(response).to have_http_status(200)
+      end
+
+      it 'updates the pinned attribute' do
+        expect(user.account.pinned?(status)).to be false
+      end
+    end
+  end
+end

spec/controllers/api/v1/statuses/reblogged_by_accounts_controller_spec.rb

@@ -0,0 +1,65 @@
+require 'rails_helper'
+
+RSpec.describe Api::V1::Statuses::RebloggedByAccountsController, type: :controller do
+  render_views
+
+  let(:user)  { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:app)   { Fabricate(:application, name: 'Test app', website: 'http://testapp.com') }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, application: app, scopes: 'read:accounts') }
+
+  context 'with an oauth token' do
+    before do
+      allow(controller).to receive(:doorkeeper_token) { token }
+    end
+
+    describe 'GET #index' do
+      let(:status) { Fabricate(:status, account: user.account) }
+
+      before do
+        Fabricate(:status, reblog_of_id: status.id)
+      end
+
+      it 'returns http success' do
+        get :index, params: { status_id: status.id, limit: 1 }
+        expect(response).to have_http_status(200)
+        expect(response.headers['Link'].links.size).to eq(2)
+      end
+    end
+  end
+
+  context 'without an oauth token' do
+    before do
+      allow(controller).to receive(:doorkeeper_token) { nil }
+    end
+
+    context 'with a private status' do
+      let(:status) { Fabricate(:status, account: user.account, visibility: :private) }
+
+      describe 'GET #index' do
+        before do
+          Fabricate(:status, reblog_of_id: status.id)
+        end
+
+        it 'returns http unautharized' do
+          get :index, params: { status_id: status.id }
+          expect(response).to have_http_status(404)
+        end
+      end
+    end
+
+    context 'with a public status' do
+      let(:status) { Fabricate(:status, account: user.account, visibility: :public) }
+
+      describe 'GET #index' do
+        before do
+          Fabricate(:status, reblog_of_id: status.id)
+        end
+
+        it 'returns http success' do
+          get :index, params: { status_id: status.id }
+          expect(response).to have_http_status(200)
+        end
+      end
+    end
+  end
+end

spec/controllers/api/v1/statuses/reblogs_controller_spec.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe Api::V1::Statuses::ReblogsController do
+  render_views
+
+  let(:user)  { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:app)   { Fabricate(:application, name: 'Test app', website: 'http://testapp.com') }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'write:statuses', application: app) }
+
+  context 'with an oauth token' do
+    before do
+      allow(controller).to receive(:doorkeeper_token) { token }
+    end
+
+    describe 'POST #create' do
+      let(:status) { Fabricate(:status, account: user.account) }
+
+      before do
+        post :create, params: { status_id: status.id }
+      end
+
+      it 'returns http success' do
+        expect(response).to have_http_status(200)
+      end
+
+      it 'updates the reblogs count' do
+        expect(status.reblogs.count).to eq 1
+      end
+
+      it 'updates the reblogged attribute' do
+        expect(user.account.reblogged?(status)).to be true
+      end
+
+      it 'return json with updated attributes' do
+        hash_body = body_as_json
+
+        expect(hash_body[:reblog][:id]).to eq status.id.to_s
+        expect(hash_body[:reblog][:reblogs_count]).to eq 1
+        expect(hash_body[:reblog][:reblogged]).to be true
+      end
+    end
+
+    describe 'POST #destroy' do
+      let(:status) { Fabricate(:status, account: user.account) }
+
+      before do
+        ReblogService.new.call(user.account, status)
+        post :destroy, params: { status_id: status.id }
+      end
+
+      it 'returns http success' do
+        expect(response).to have_http_status(200)
+      end
+
+      it 'updates the reblogs count' do
+        expect(status.reblogs.count).to eq 0
+      end
+
+      it 'updates the reblogged attribute' do
+        expect(user.account.reblogged?(status)).to be false
+      end
+    end
+  end
+end

spec/controllers/api/v1/statuses_controller_spec.rb

@@ -0,0 +1,132 @@
+require 'rails_helper'
+
+RSpec.describe Api::V1::StatusesController, type: :controller do
+  render_views
+
+  let(:user)  { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:app)   { Fabricate(:application, name: 'Test app', website: 'http://testapp.com') }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, application: app, scopes: scopes) }
+
+  context 'with an oauth token' do
+    before do
+      allow(controller).to receive(:doorkeeper_token) { token }
+    end
+
+    describe 'GET #show' do
+      let(:scopes) { 'read:statuses' }
+      let(:status) { Fabricate(:status, account: user.account) }
+
+      it 'returns http success' do
+        get :show, params: { id: status.id }
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    describe 'GET #context' do
+      let(:scopes) { 'read:statuses' }
+      let(:status) { Fabricate(:status, account: user.account) }
+
+      before do
+        Fabricate(:status, account: user.account, thread: status)
+      end
+
+      it 'returns http success' do
+        get :context, params: { id: status.id }
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    describe 'POST #create' do
+      let(:scopes) { 'write:statuses' }
+
+      before do
+        post :create, params: { status: 'Hello world' }
+      end
+
+      it 'returns http success' do
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    describe 'DELETE #destroy' do
+      let(:scopes) { 'write:statuses' }
+      let(:status) { Fabricate(:status, account: user.account) }
+
+      before do
+        post :destroy, params: { id: status.id }
+      end
+
+      it 'returns http success' do
+        expect(response).to have_http_status(200)
+      end
+
+      it 'removes the status' do
+        expect(Status.find_by(id: status.id)).to be nil
+      end
+    end
+  end
+
+  context 'without an oauth token' do
+    before do
+      allow(controller).to receive(:doorkeeper_token) { nil }
+    end
+
+    context 'with a private status' do
+      let(:status) { Fabricate(:status, account: user.account, visibility: :private) }
+
+      describe 'GET #show' do
+        it 'returns http unautharized' do
+          get :show, params: { id: status.id }
+          expect(response).to have_http_status(404)
+        end
+      end
+
+      describe 'GET #context' do
+        before do
+          Fabricate(:status, account: user.account, thread: status)
+        end
+
+        it 'returns http unautharized' do
+          get :context, params: { id: status.id }
+          expect(response).to have_http_status(404)
+        end
+      end
+
+      describe 'GET #card' do
+        it 'returns http unautharized' do
+          get :card, params: { id: status.id }
+          expect(response).to have_http_status(404)
+        end
+      end
+    end
+
+    context 'with a public status' do
+      let(:status) { Fabricate(:status, account: user.account, visibility: :public) }
+
+      describe 'GET #show' do
+        it 'returns http success' do
+          get :show, params: { id: status.id }
+          expect(response).to have_http_status(200)
+        end
+      end
+
+      describe 'GET #context' do
+        before do
+          Fabricate(:status, account: user.account, thread: status)
+        end
+
+        it 'returns http success' do
+          get :context, params: { id: status.id }
+          expect(response).to have_http_status(200)
+        end
+      end
+
+      describe 'GET #card' do
+        it 'returns http success' do
+          get :card, params: { id: status.id }
+          expect(response).to have_http_status(200)
+        end
+      end
+    end
+  end
+end

spec/controllers/api/v1/streaming_controller_spec.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe Api::V1::StreamingController do
+  around(:each) do |example|
+    before = Rails.configuration.x.streaming_api_base_url
+    Rails.configuration.x.streaming_api_base_url = Rails.configuration.x.web_domain
+    example.run
+    Rails.configuration.x.streaming_api_base_url = before
+  end
+
+  before(:each) do
+    request.headers.merge! Host: Rails.configuration.x.web_domain
+  end
+
+  context 'with streaming api on same host' do
+    describe 'GET #index' do
+      it 'raises ActiveRecord::RecordNotFound' do
+        get :index
+        expect(response).to have_http_status(404)
+      end
+    end
+  end
+
+  context 'with streaming api on different host' do
+    before(:each) do
+      Rails.configuration.x.streaming_api_base_url = 'wss://streaming-' + Rails.configuration.x.web_domain
+      @streaming_host = URI.parse(Rails.configuration.x.streaming_api_base_url).host
+    end
+
+    describe 'GET #index' do
+      it 'redirects to streaming host' do
+        get :index, params: { access_token: 'deadbeef', stream: 'public' }
+        expect(response).to have_http_status(301)
+        request_uri = URI.parse(request.url)
+        redirect_to_uri = URI.parse(response.location)
+        [:scheme, :path, :query, :fragment].each do |part|
+          expect(redirect_to_uri.send(part)).to eq(request_uri.send(part)), "redirect target #{part}"
+        end
+        expect(redirect_to_uri.host).to eq(@streaming_host), "redirect target host"
+      end
+    end
+  end
+end

spec/controllers/api/v1/suggestions_controller_spec.rb

@@ -0,0 +1,35 @@
+require 'rails_helper'
+
+RSpec.describe Api::V1::SuggestionsController, type: :controller do
+  render_views
+
+  let(:user)  { Fabricate(:user) }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read write') }
+
+  before do
+    allow(controller).to receive(:doorkeeper_token) { token }
+  end
+
+  describe 'GET #index' do
+    let(:bob) { Fabricate(:account) }
+    let(:jeff) { Fabricate(:account) }
+
+    before do
+      PotentialFriendshipTracker.record(user.account_id, bob.id, :reblog)
+      PotentialFriendshipTracker.record(user.account_id, jeff.id, :favourite)
+
+      get :index
+    end
+
+    it 'returns http success' do
+      expect(response).to have_http_status(200)
+    end
+
+    it 'returns accounts' do
+      json = body_as_json
+
+      expect(json.size).to be >= 1
+      expect(json.map { |i| i[:id] }).to include *[bob, jeff].map { |i| i.id.to_s }
+    end
+  end
+end

spec/controllers/api/v1/timelines/direct_controller_spec.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Api::V1::Timelines::DirectController, type: :controller do
+  let(:user)  { Fabricate(:user) }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read:statuses') }
+
+  describe 'GET #show' do
+    it 'returns 200' do
+      allow(controller).to receive(:doorkeeper_token) { token }
+      get :show
+
+      expect(response).to have_http_status(200)
+    end
+  end
+end

spec/controllers/api/v1/timelines/home_controller_spec.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe Api::V1::Timelines::HomeController do
+  render_views
+
+  let(:user) { Fabricate(:user, account: Fabricate(:account, username: 'alice'), current_sign_in_at: 1.day.ago) }
+
+  before do
+    allow(controller).to receive(:doorkeeper_token) { token }
+  end
+
+  context 'with a user context' do
+    let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read:statuses') }
+
+    describe 'GET #show' do
+      before do
+        follow = Fabricate(:follow, account: user.account)
+        PostStatusService.new.call(follow.target_account, text: 'New status for user home timeline.')
+      end
+
+      it 'returns http success' do
+        get :show
+
+        expect(response).to have_http_status(200)
+        expect(response.headers['Link'].links.size).to eq(2)
+      end
+    end
+  end
+
+  context 'without a user context' do
+    let(:token) { Fabricate(:accessible_access_token, resource_owner_id: nil, scopes: 'read') }
+
+    describe 'GET #show' do
+      it 'returns http unprocessable entity' do
+        get :show
+
+        expect(response).to have_http_status(:unprocessable_entity)
+        expect(response.headers['Link']).to be_nil
+      end
+    end
+  end
+end

spec/controllers/api/v1/timelines/list_controller_spec.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe Api::V1::Timelines::ListController do
+  render_views
+
+  let(:user) { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+  let(:list) { Fabricate(:list, account: user.account) }
+
+  before do
+    allow(controller).to receive(:doorkeeper_token) { token }
+  end
+
+  context 'with a user context' do
+    let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read:lists') }
+
+    describe 'GET #show' do
+      before do
+        follow = Fabricate(:follow, account: user.account)
+        list.accounts << follow.target_account
+        PostStatusService.new.call(follow.target_account, text: 'New status for user home timeline.')
+      end
+
+      it 'returns http success' do
+        get :show, params: { id: list.id }
+        expect(response).to have_http_status(200)
+      end
+    end
+  end
+
+  context 'with the wrong user context' do
+    let(:other_user) { Fabricate(:user, account: Fabricate(:account, username: 'bob')) }
+    let(:token)      { Fabricate(:accessible_access_token, resource_owner_id: other_user.id, scopes: 'read') }
+
+    describe 'GET #show' do
+      it 'returns http not found' do
+        get :show, params: { id: list.id }
+        expect(response).to have_http_status(:not_found)
+      end
+    end
+  end
+
+  context 'without a user context' do
+    let(:token) { Fabricate(:accessible_access_token, resource_owner_id: nil, scopes: 'read') }
+
+    describe 'GET #show' do
+      it 'returns http unprocessable entity' do
+        get :show, params: { id: list.id }
+
+        expect(response).to have_http_status(:unprocessable_entity)
+        expect(response.headers['Link']).to be_nil
+      end
+    end
+  end
+end

spec/controllers/api/v1/timelines/public_controller_spec.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe Api::V1::Timelines::PublicController do
+  render_views
+
+  let(:user) { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+
+  before do
+    allow(controller).to receive(:doorkeeper_token) { token }
+  end
+
+  context 'with a user context' do
+    let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id) }
+
+    describe 'GET #show' do
+      before do
+        PostStatusService.new.call(user.account, text: 'New status from user for federated public timeline.')
+      end
+
+      it 'returns http success' do
+        get :show
+
+        expect(response).to have_http_status(200)
+        expect(response.headers['Link'].links.size).to eq(2)
+      end
+    end
+
+    describe 'GET #show with local only' do
+      before do
+        PostStatusService.new.call(user.account, text: 'New status from user for local public timeline.')
+      end
+
+      it 'returns http success' do
+        get :show, params: { local: true }
+
+        expect(response).to have_http_status(200)
+        expect(response.headers['Link'].links.size).to eq(2)
+      end
+    end
+  end
+
+  context 'without a user context' do
+    let(:token) { Fabricate(:accessible_access_token, resource_owner_id: nil) }
+
+    describe 'GET #show' do
+      it 'returns http success' do
+        get :show
+
+        expect(response).to have_http_status(200)
+        expect(response.headers['Link']).to be_nil
+      end
+    end
+  end
+end

spec/controllers/api/v1/timelines/tag_controller_spec.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe Api::V1::Timelines::TagController do
+  render_views
+
+  let(:user) { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
+
+  before do
+    allow(controller).to receive(:doorkeeper_token) { token }
+  end
+
+  context 'with a user context' do
+    let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id) }
+
+    describe 'GET #show' do
+      before do
+        PostStatusService.new.call(user.account, text: 'It is a #test')
+      end
+
+      it 'returns http success' do
+        get :show, params: { id: 'test' }
+        expect(response).to have_http_status(200)
+        expect(response.headers['Link'].links.size).to eq(2)
+      end
+    end
+  end
+
+  context 'without a user context' do
+    let(:token) { Fabricate(:accessible_access_token, resource_owner_id: nil) }
+
+    describe 'GET #show' do
+      it 'returns http success' do
+        get :show, params: { id: 'test' }
+        expect(response).to have_http_status(200)
+        expect(response.headers['Link']).to be_nil
+      end
+    end
+  end
+end