End-to-end tests against the pasture; profiles, follows, search, votes, reactions

tests/e2e (Playwright for .NET 1.61.0 on xunit v3, the Chromium 1228 already
cached, never downloaded, never in CI) runs the published app against
SocialPub's pasture and its town: run.sh publishes it with the Pasture
environment (wwwroot/appsettings.Pasture.json, published only then; the
deploy fails if it ever ships) and serves it as https://decepub.test. The
tests sign in through the real login page and persona chooser, check that
every request goes only to decepub.test and privapub.test with the right
credential on the right API, render one post of each kind from each
platform as its author wrote it, and check every action on the other
side of the wire (town.sh stored): favourites, boosts and replies with
their undoing, follows from a profile, votes, reactions. Each test is also
a cell of the town's report (out/client.jsonl). They found two PrivaPub
bugs fixed there (a blocked author's status answered null; sensitive
remote media invented a content warning) and a reply addressed to nobody.

New in the app, all checked by those tests:
- profiles at /account/{id}: header, bio, fields, counts, the account's
  posts as posts, posts and replies, or media, and follow, unfollow,
  cancel a request, mute and block (AccountService); post authors and
  notifications open them in the app;
- search at /search: accounts, posts and hashtags, a handle or an address
  resolved by PrivaPub;
- poll voting on the card, and emoji reactions shown and given with one
  tap; before a persona's first reaction or vote it is told once that
  both are public (PublicNoticeService, the owner's decision);
- follow requests answered from their notification.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

Components/Content.razor

@@ -4,20 +4,22 @@
    The card does its own Mastodon actions (favourite, boost, bookmark, reply, mute, block, delete) and tells the page
    about replies and deletions. data-post-* attributes tell the globe where the post is (wwwroot/js/globe.js); a
    quoted post (Compact) has none, since it is not an item of the feed. A CDN-fronted server's post has no point, only
-   its CDN's group (data-cdn); data-post-at is when it was written, for the globe's Sun. Located posts have no actions: PrivaPub keeps them off the Mastodon API. Nerd stats are on
+   its CDN's group (data-cdn); data-post-at is when it was written, for the globe's Sun; data-uri is its ActivityPub id,
+   which the e2e tests (tests/e2e) find it by. Located posts have no actions: PrivaPub keeps them off the Mastodon API. Nerd stats are on
    the time, the author and its server's history, the place or the CDN, the media and the counts. *@
 <article class="flex gap-3 w-full rounded-xl neo-raised @(Highlighted ? "neo-sm" : "neo-2xs") @CssContainer"
 		 data-post-id="@(Compact ? null : Post.Key)" data-lat="@(Compact || Post.Location?.HasPoint != true ? null : Coordinate(Post.Location.Latitude))"
 		 data-lng="@(Compact || Post.Location?.HasPoint != true ? null : Coordinate(Post.Location.Longitude))"
 		 data-src="@(Compact ? null : Post.Location?.Source.ToString().ToLowerInvariant())" data-cdn="@(Compact ? null : Post.Location?.CdnKey)"
 		 data-label="@(Compact ? null : Post.Location?.Label)" data-host="@(Compact ? null : Post.Host)"
-		 data-range="@(Post.Located && !Compact ? Coordinate(Post.RangeKm) : null)" data-post-at="@(Compact ? null : Post.WrittenAt?.ToString("O"))">
+		 data-range="@(Post.Located && !Compact ? Coordinate(Post.RangeKm) : null)" data-post-at="@(Compact ? null : Post.WrittenAt?.ToString("O"))"
+		 data-uri="@(Compact ? null : Post.Status?.Uri)">
 
 	@if (Author is { } author)
 	{
 		<div class="flex flex-col py-3 pl-3 md:py-4 md:pl-4 flex-none rounded-l-xl bg-cover bg-no-repeat bg-center"
 			 style="@HeaderBackground(author)">
-			<a class="block h-12 w-12 md:h-14 md:w-14" href="@author.Url" target="_blank" rel="noopener noreferrer" title="@author.Acct">
+			<a class="block h-12 w-12 md:h-14 md:w-14" href="@($"account/{Uri.EscapeDataString(author.Id)}")" title="@author.Acct">
 				@* alt="": the author's name is next to it. *@
 				<img alt="" loading="lazy" class="h-12 w-12 md:h-14 md:w-14 object-cover rounded-full neo-raised neo-2xs bg-base-100"
 					 src="@(author.Avatar ?? "imgs/icon-192.png")" />
@@ -153,6 +155,17 @@
 								 OnClick="() => Act(status.Bookmarked ? StatusAction.Unbookmark : StatusAction.Bookmark)" title="@Localizer["Bookmark"]">
 							<i aria-hidden="true" class="ion-md-bookmark text-lg @(status.Bookmarked ? "text-warning" : null)"></i>
 						</DButton>
+						<DDropdown @bind-IsOpen="isReactionsOpen" Placement="DDropdownPlacement.Top" CloseOnContentClick="true"
+								   TriggerClass="@(isReactionsOpen ? "btn btn-sm btn-active" : "btn btn-sm")" ContentClass="mb-2 flex gap-1 p-2 rounded-box"
+								   title="@Localizer["React"]">
+							<Trigger><i aria-hidden="true" class="ion-md-happy text-lg"></i></Trigger>
+							<ChildContent>
+								@foreach (var emoji in QuickReactions)
+								{
+									<DButton Size="DSize.Sm" Disabled="@(IsDefaultDisabled || isActing)" OnClick="() => React(emoji, true)">@emoji</DButton>
+								}
+							</ChildContent>
+						</DDropdown>
 						<NerdTip Heading="@Localizer["Counts"]" Rows="CountRows(status)" Class="self-center">
 							<i class="ion-md-stats opacity-40" aria-label="@Localizer["Counts"]"></i>
 						</NerdTip>
@@ -211,8 +224,24 @@
 		else if (Post.Notification?.Account is { } follower)
 		{
 			<p class="text-sm">
-				<b>@follower.Name</b> <span class="opacity-60">@("@" + follower.Acct)</span>
+				<a class="font-bold" href="@($"account/{Uri.EscapeDataString(follower.Id)}")">@follower.Name</a>
+				<span class="opacity-60">@("@" + follower.Acct)</span>
 			</p>
+			@if (Post.Notification.Type == "follow_request" && requestAnswer is null)
+			{
+				<div class="flex gap-2">
+					<DButton Size="DSize.Sm" Color="DColor.Primary" Disabled="@(IsDefaultDisabled || isActing)" OnClick="() => AnswerRequest(follower, true)">
+						<i class="ion-md-checkmark"></i><span>@Localizer["Accept"]</span>
+					</DButton>
+					<DButton Size="DSize.Sm" Disabled="@(IsDefaultDisabled || isActing)" OnClick="() => AnswerRequest(follower, false)">
+						<i class="ion-md-close"></i><span>@Localizer["Refuse"]</span>
+					</DButton>
+				</div>
+			}
+			else if (requestAnswer is { } accepted)
+			{
+				<p class="text-xs opacity-70">@(accepted ? Localizer["Accepted."] : Localizer["Refused."])</p>
+			}
 		}
 	</div>
 
@@ -295,14 +324,43 @@
 
 		@if (status.Poll is { } poll)
 		{
-			<div class="flex flex-col gap-1 text-xs">
-				@foreach (var option in poll.Options)
+			<div class="flex flex-col gap-1 text-xs" data-poll>
+				@if (CanVote(poll))
 				{
-					var share = poll.VotesCount > 0 && option.VotesCount is { } votes ? votes * 100d / poll.VotesCount : 0;
-					<div class="relative rounded-md overflow-hidden neo-inset neo-2xs px-2 py-1">
-						<div class="absolute inset-y-0 left-0 bg-primary/20" style="width:@(share.ToString("0.#", System.Globalization.CultureInfo.InvariantCulture))%"></div>
-						<span class="relative flex justify-between gap-2"><span>@option.Title</span><span>@share.ToString("0")%</span></span>
-					</div>
+					@for (var i = 0; i < poll.Options.Count; i++)
+					{
+						var index = i;
+						<label class="flex items-center gap-2 rounded-md neo-inset neo-2xs px-2 py-1 cursor-pointer">
+							<input type="@(poll.Multiple ? "checkbox" : "radio")" class="@(poll.Multiple ? "checkbox checkbox-xs" : "radio radio-xs")"
+								   name="@($"poll-{poll.Id}")" checked="@pollChoices.Contains(index)" @onchange="() => ToggleChoice(poll, index)" />
+							<span>@poll.Options[index].Title</span>
+						</label>
+					}
+					<DButton Size="DSize.Xs" Color="DColor.Primary" class="self-start" Disabled="@(IsDefaultDisabled || isActing || pollChoices.Count == 0)"
+							 OnClick="() => Vote(poll)">
+						@Localizer["Vote"]
+					</DButton>
+				}
+				else
+				{
+					@for (var i = 0; i < poll.Options.Count; i++)
+					{
+						var option = poll.Options[i];
+						var share = poll.VotesCount > 0 && option.VotesCount is { } votes ? votes * 100d / poll.VotesCount : 0;
+						<div class="relative rounded-md overflow-hidden neo-inset neo-2xs px-2 py-1">
+							<div class="absolute inset-y-0 left-0 bg-primary/20" style="width:@(share.ToString("0.#", System.Globalization.CultureInfo.InvariantCulture))%"></div>
+							<span class="relative flex justify-between gap-2">
+								<span>
+									@option.Title
+									@if (poll.OwnVotes.Contains(i))
+									{
+										<i class="ion-md-checkmark-circle text-primary" title="@Localizer["Your vote"]" aria-label="@Localizer["Your vote"]"></i>
+									}
+								</span>
+								<span>@share.ToString("0")%</span>
+							</span>
+						</div>
+					}
 				}
 				<span class="opacity-60">@Localizer["{0} votes", poll.VotesCount] · @(poll.Expired ? Localizer["closed"] : Localizer["open"])</span>
 			</div>
@@ -324,6 +382,27 @@
 			<Content Post="FeedPost.Of(quoted)" Compact="true" IncludeExpand="false" CssContainer="neo-inset! shadow-none" />
 		}
 
+		@if (status.EmojiReactions.Count > 0)
+		{
+			<div class="flex flex-wrap gap-1" data-reactions>
+				@foreach (var reaction in status.EmojiReactions)
+				{
+					<DButton Size="DSize.Xs" Active="reaction.Me" Disabled="@(IsDefaultDisabled || isActing || Compact || Post.Located)"
+							 OnClick="() => React(reaction.Name, !reaction.Me)" title="@reaction.Name">
+						@if (reaction.Url is { Length: > 0 } image)
+						{
+							<img alt="@reaction.Name" class="h-4 w-4 object-contain" src="@image" />
+						}
+						else
+						{
+							<span>@reaction.Name</span>
+						}
+						<span class="tabular-nums">@reaction.Count</span>
+					</DButton>
+				}
+			</div>
+		}
+
 		@if (status.Tags.Count > 0)
 		{
 			<div class="flex flex-wrap gap-1">
@@ -366,6 +445,76 @@
 		Post.Status = updated.Reblog ?? updated;
 	}
 
+	[Inject] AccountService AccountService { get; set; }
+	[Inject] PublicNoticeService Notices { get; set; }
+
+	bool? requestAnswer;
+
+	async Task AnswerRequest(Account follower, bool accept)
+	{
+		isActing = true;
+		var result = await AccountService.Answer(follower.Id, accept);
+		isActing = false;
+		if (result.IsInvalid)
+		{
+			Toast.AddResponseError(result);
+			return;
+		}
+
+		requestAnswer = accept;
+	}
+
+	static readonly string[] QuickReactions = ["👍", "❤️", "😂", "🎉", "🔥", "😮", "😢"];
+
+	bool isReactionsOpen;
+
+	async Task React(string emoji, bool add)
+	{
+		if (add && !await Notices.Confirm(CascadingState.PersonaId))
+			return;
+		isActing = true;
+		var result = await StatusService.React(Status.Id, emoji, add);
+		isActing = false;
+		if (result.IsInvalid)
+		{
+			Toast.AddResponseError(result);
+			return;
+		}
+
+		var updated = (Status)result.Data;
+		Status.EmojiReactions = (updated?.Reblog ?? updated)?.EmojiReactions ?? Status.EmojiReactions;
+	}
+
+	HashSet<int> pollChoices = [];
+
+	bool CanVote(Poll poll) => !poll.Expired && poll.Voted != true && !IsOwn && !Compact && !Post.Located;
+
+	void ToggleChoice(Poll poll, int index)
+	{
+		if (!poll.Multiple)
+			pollChoices.Clear();
+		if (!pollChoices.Remove(index))
+			pollChoices.Add(index);
+	}
+
+	async Task Vote(Poll poll)
+	{
+		if (!await Notices.Confirm(CascadingState.PersonaId))
+			return;
+		isActing = true;
+		var result = await StatusService.Vote(poll.Id, pollChoices);
+		isActing = false;
+		if (result.IsInvalid)
+		{
+			Toast.AddResponseError(result);
+			return;
+		}
+
+		Status.Poll = (Poll)result.Data ?? poll;
+		pollChoices.Clear();
+		Toast.AddResponseSuccess(Localizer["Voted."]);
+	}
+
 	async Task Delete()
 	{
 		isActing = true;

Components/PublicNoticeHost.razor

@@ -0,0 +1,34 @@
+@inherits LocalizableComponentBase
+@implements IDisposable
+
+@* The one-time notice before a persona's first reaction or poll vote (PublicNoticeService), in MainLayout. *@
+<DModal IsOpen="Notices.IsAsking" IsOpenChanged="Closed" CloseOnBackdrop="false" CloseText="@Localizer["Close"]">
+	<Heading>@Localizer["Reactions and votes are public"]</Heading>
+	<ChildContent>
+		<p class="text-sm">@Localizer["Anyone who can see the post can see that {0} reacted to it or voted in it. Your other personas are never named.", CascadingState.Persona?.Name ?? ""]</p>
+	</ChildContent>
+	<Actions>
+		<DButton Size="DSize.Sm" OnClick="() => Notices.Answer(false)">@Localizer["Cancel"]</DButton>
+		<DButton Size="DSize.Sm" Color="DColor.Primary" OnClick="() => Notices.Answer(true)">@Localizer["Continue"]</DButton>
+	</Actions>
+</DModal>
+
+@code {
+	[Inject] PublicNoticeService Notices { get; set; }
+
+	protected override void OnInitialized()
+	{
+		Notices.Changed += Refresh;
+		IsLoading = false;
+	}
+
+	void Refresh() => InvokeAsync(StateHasChanged);
+
+	void Closed(bool open)
+	{
+		if (!open)
+			Notices.Answer(false);
+	}
+
+	public void Dispose() => Notices.Changed -= Refresh;
+}