Merge commit '93f3c724aea4efe874054b2f546fff91f0bf731b' into glitch-soc/merge-upstream

Conflicts:
- `spec/system/settings/preferences/appearance_spec.rb`:
  Upstream tests for changing themes in there, but glitch-soc has
  its own place for that.
  Updated upstream's change while skipping the theme test.

spec/requests/admin/account_actions_spec.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Account Actions' do
+  describe 'POST /admin/accounts/:account_id/action' do
+    before { sign_in Fabricate(:admin_user) }
+
+    let(:account) { Fabricate :account }
+
+    it 'gracefully handles invalid nested params' do
+      post admin_account_action_path(account.id, admin_account_action: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/admin/account_moderation_notes_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Account Moderation Notes' do
+  describe 'POST /admin/account_moderation_notes' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post admin_account_moderation_notes_path(account_moderation_note: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/admin/accounts_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Accounts' do
+  describe 'POST /admin/accounts/batch' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post batch_admin_accounts_path(form_account_batch: 'invalid')
+
+      expect(response)
+        .to redirect_to(admin_accounts_path)
+    end
+  end
+end

spec/requests/admin/announcements_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Announcements' do
+  describe 'POST /admin/announcements' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post admin_announcements_path(announcement: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/admin/change_emails_spec.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Account Change Email' do
+  describe 'PUT /admin/accounts/:account_id/change_email' do
+    before { sign_in Fabricate(:admin_user) }
+
+    let(:account) { Fabricate :account }
+
+    it 'gracefully handles invalid nested params' do
+      put admin_account_change_email_path(account.id, user: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/admin/custom_emojis_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Custom Emojis' do
+  describe 'POST /admin/custom_emojis' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post admin_custom_emojis_path(custom_emoji: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/admin/domain_allows_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Domain Allows' do
+  describe 'POST /admin/domain_allows' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post admin_domain_allows_path(domain_allow: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/admin/domain_blocks_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Domain Blocks' do
+  describe 'POST /admin/domain_blocks/batch' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post batch_admin_domain_blocks_path(form_domain_block_batch: 'invalid')
+
+      expect(response)
+        .to redirect_to(admin_instances_path(limited: '1'))
+    end
+  end
+end

spec/requests/admin/email_domain_blocks_spec.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Email Domain Blocks' do
+  describe 'POST /admin/email_domain_blocks' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post admin_email_domain_blocks_path(email_domain_block: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+
+  describe 'POST /admin/email_domain_blocks/batch' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post batch_admin_email_domain_blocks_path(form_email_domain_block_batch: 'invalid')
+
+      expect(response)
+        .to redirect_to(admin_email_domain_blocks_path)
+    end
+  end
+end

spec/requests/admin/export_domain_allows_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Export Domain Allows' do
+  describe 'POST /admin/export_domain_allows/import' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post import_admin_export_domain_allows_path(admin_import: 'invalid')
+
+      expect(response)
+        .to redirect_to(admin_instances_path)
+    end
+  end
+end

spec/requests/admin/export_domain_blocks_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Export Domain Blocks' do
+  describe 'POST /admin/export_domain_blocks/import' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post import_admin_export_domain_blocks_path(admin_import: 'invalid')
+
+      expect(response.body)
+        .to include(I18n.t('admin.export_domain_blocks.no_file'))
+    end
+  end
+end

spec/requests/admin/follow_recommendations_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Follow Recommendations' do
+  describe 'PUT /admin/follow_recommendations' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      put admin_follow_recommendations_path(form_account_batch: 'invalid')
+
+      expect(response)
+        .to redirect_to(admin_follow_recommendations_path)
+    end
+  end
+end

spec/requests/admin/invites_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Invites' do
+  describe 'POST /admin/invites' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post admin_invites_path(invite: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/admin/ip_blocks_spec.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin IP Blocks' do
+  describe 'POST /admin/ip_blocks' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post admin_ip_blocks_path(ip_block: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+
+  describe 'POST /admin/ip_blocks/batch' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post batch_admin_ip_blocks_path(form_ip_block_batch: 'invalid')
+
+      expect(response)
+        .to redirect_to(admin_ip_blocks_path)
+    end
+  end
+end

spec/requests/admin/relays_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Relays' do
+  describe 'POST /admin/relays' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post admin_relays_path(relay: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/admin/report_notes_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Report Notes' do
+  describe 'POST /admin/report_notes' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post admin_report_notes_path(report_note: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/admin/roles_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Roles' do
+  describe 'POST /admin/roles' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post admin_roles_path(user_role: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/admin/rules_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Rules' do
+  describe 'POST /admin/rules' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post admin_rules_path(rule: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/admin/settings/about_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Settings About' do
+  describe 'PUT /admin/settings/about' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      put admin_settings_about_path(form_admin_settings: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/admin/statuses_spec.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Statuses' do
+  describe 'POST /admin/accounts/:account_id/statuses/batch' do
+    before { sign_in Fabricate(:admin_user) }
+
+    let(:account) { Fabricate :account }
+
+    it 'gracefully handles invalid nested params' do
+      post batch_admin_account_statuses_path(account.id, admin_status_batch_action: 'invalid')
+
+      expect(response)
+        .to redirect_to(admin_account_statuses_path(account.id))
+    end
+  end
+end

spec/requests/admin/tags_spec.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Tags' do
+  describe 'PUT /admin/tags/:id' do
+    before { sign_in Fabricate(:admin_user) }
+
+    let(:tag) { Fabricate :tag }
+
+    it 'gracefully handles invalid nested params' do
+      put admin_tag_path(tag.id, tag: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/admin/terms_of_service/drafts_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Terms Drafts' do
+  describe 'PUT /admin/terms_of_service/draft' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      put admin_terms_of_service_draft_path(terms_of_service: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/admin/terms_of_service/generates_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Terms Generates' do
+  describe 'POST /admin/terms_of_service/generates' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post admin_terms_of_service_generate_path(terms_of_service_generator: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/admin/trends/links/preview_card_providers_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Trends Links Preview Card Providers' do
+  describe 'POST /admin/trends/links/publishers/batch' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post batch_admin_trends_links_preview_card_providers_path(trends_preview_card_provider_batch: 'invalid')
+
+      expect(response)
+        .to redirect_to(admin_trends_links_preview_card_providers_path)
+    end
+  end
+end

spec/requests/admin/trends/links_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Trends Links' do
+  describe 'POST /admin/trends/links/batch' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post batch_admin_trends_links_path(trends_preview_card_batch: 'invalid')
+
+      expect(response)
+        .to redirect_to(admin_trends_links_path)
+    end
+  end
+end

spec/requests/admin/trends/statuses_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Trends Statuses' do
+  describe 'POST /admin/trends/statuses/batch' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post batch_admin_trends_statuses_path(trends_status_batch: 'invalid')
+
+      expect(response)
+        .to redirect_to(admin_trends_statuses_path)
+    end
+  end
+end

spec/requests/admin/trends/tags_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Trends Tags' do
+  describe 'POST /admin/trends/tags/batch' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post batch_admin_trends_tags_path(trends_tag_batch: 'invalid')
+
+      expect(response)
+        .to redirect_to(admin_trends_tags_path)
+    end
+  end
+end

spec/requests/admin/users/roles_spec.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Users Roles' do
+  describe 'PUT /admin/users/:user_id/role' do
+    before { sign_in Fabricate(:admin_user) }
+
+    let(:user) { Fabricate :user }
+
+    it 'gracefully handles invalid nested params' do
+      put admin_user_role_path(user.id, user: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/admin/warning_presets_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Warning Presets' do
+  describe 'POST /admin/warning_presets' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post admin_warning_presets_path(account_warning_preset: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/admin/webhooks_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Admin Webhooks' do
+  describe 'POST /admin/webhooks' do
+    before { sign_in Fabricate(:admin_user) }
+
+    it 'gracefully handles invalid nested params' do
+      post admin_webhooks_path(webhook: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/auth/challenges_spec.rb

@@ -33,5 +33,14 @@ RSpec.describe 'Auth Challenges' do
           .to be_nil
       end
     end
+
+    context 'with invalid params' do
+      it 'gracefully handles invalid nested params' do
+        post auth_challenge_path(form_challenge: 'invalid')
+
+        expect(response)
+          .to have_http_status(400)
+      end
+    end
   end
 end

spec/requests/auth/sessions_spec.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Auth Sessions' do
+  describe 'POST /auth/sign_in' do
+    # The rack-attack check has issues with the non-nested invalid param used here
+    before { Rack::Attack.enabled = false }
+    after { Rack::Attack.enabled = true }
+
+    it 'gracefully handles invalid nested params' do
+      post user_session_path(user: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/filters/statuses_spec.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Filters Statuses' do
+  describe 'POST /filters/:filter_id/statuses/batch' do
+    before { sign_in(user) }
+
+    let(:filter) { Fabricate :custom_filter, account: user.account }
+    let(:user) { Fabricate :user }
+
+    it 'gracefully handles invalid nested params' do
+      post batch_filter_statuses_path(filter.id, form_status_filter_batch_action: 'invalid')
+
+      expect(response)
+        .to redirect_to(edit_filter_path(filter))
+    end
+  end
+end

spec/requests/relationships_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Relationships' do
+  describe 'PUT /relationships' do
+    before { sign_in Fabricate(:user) }
+
+    it 'gracefully handles invalid nested params' do
+      put relationships_path(form_account_batch: 'invalid')
+
+      expect(response)
+        .to redirect_to(relationships_path)
+    end
+  end
+end

spec/requests/settings/applications_spec.rb

@@ -40,5 +40,23 @@ RSpec.describe 'Settings / Exports' do
       expect(response)
         .to redirect_to(settings_applications_path)
     end
+
+    it 'gracefully handles invalid nested params' do
+      post settings_applications_path(doorkeeper_application: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+
+  describe 'PUT /settings/applications/:id' do
+    let(:application) { Fabricate :application, owner: user }
+
+    it 'gracefully handles invalid nested params' do
+      put settings_application_path(application.id, doorkeeper_application: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
   end
 end

spec/requests/settings/preferences/appearance_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Settings Preferences Appearance' do
+  describe 'PUT /settings/preferences/appearance' do
+    before { sign_in Fabricate(:user) }
+
+    it 'gracefully handles invalid nested params' do
+      put settings_preferences_appearance_path(user: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/settings/two_factor_authentication/confirmations_spec.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Settings 2FA Confirmations' do
+  describe 'POST /settings/two_factor_authentication/confirmations' do
+    before do
+      sign_in Fabricate(:user, encrypted_password: '') # Empty encrypted password avoids challengable flow
+      post settings_otp_authentication_path # Sets `session[:new_otp_secret]` which is needed for next step
+    end
+
+    it 'gracefully handles invalid nested params' do
+      post settings_two_factor_authentication_confirmation_path(form_two_factor_confirmation: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end

spec/requests/settings/verifications_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Settings Verifications' do
+  describe 'PUT /settings/verification' do
+    before { sign_in Fabricate(:user) }
+
+    it 'gracefully handles invalid nested params' do
+      put settings_verification_path(account: 'invalid')
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
+end