End-to-end tests against the pasture; profiles, follows, search, votes, reactions

tests/e2e (Playwright for .NET 1.61.0 on xunit v3, the Chromium 1228 already
cached, never downloaded, never in CI) runs the published app against
SocialPub's pasture and its town: run.sh publishes it with the Pasture
environment (wwwroot/appsettings.Pasture.json, published only then; the
deploy fails if it ever ships) and serves it as https://decepub.test. The
tests sign in through the real login page and persona chooser, check that
every request goes only to decepub.test and privapub.test with the right
credential on the right API, render one post of each kind from each
platform as its author wrote it, and check every action on the other
side of the wire (town.sh stored): favourites, boosts and replies with
their undoing, follows from a profile, votes, reactions. Each test is also
a cell of the town's report (out/client.jsonl). They found two PrivaPub
bugs fixed there (a blocked author's status answered null; sensitive
remote media invented a content warning) and a reply addressed to nobody.

New in the app, all checked by those tests:
- profiles at /account/{id}: header, bio, fields, counts, the account's
  posts as posts, posts and replies, or media, and follow, unfollow,
  cancel a request, mute and block (AccountService); post authors and
  notifications open them in the app;
- search at /search: accounts, posts and hashtags, a handle or an address
  resolved by PrivaPub;
- poll voting on the card, and emoji reactions shown and given with one
  tap; before a persona's first reaction or vote it is told once that
  both are public (PublicNoticeService, the owner's decision);
- follow requests answered from their notification.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

Services/AccountService.cs

@@ -0,0 +1,162 @@
+using System.Net;
+
+using collAnon.Client.Services;
+
+using decePubClient.Extensions;
+using decePubClient.Models;
+using decePubClient.Models.Mastodon;
+
+using PrivaPub.ClientModels;
+
+namespace decePubClient.Services
+{
+	/// <summary>What the current persona does to and learns of other accounts.</summary>
+	public enum AccountAction
+	{
+		Follow,
+		Unfollow,
+		Block,
+		Unblock,
+		Mute,
+		Unmute
+	}
+
+	/// <summary>Which of an account's posts its profile lists.</summary>
+	public enum ProfileTab
+	{
+		Posts,
+		PostsAndReplies,
+		Media
+	}
+
+	/// <summary>
+	/// Accounts as the current persona sees them: a profile, its relationship to the persona, its posts, following,
+	/// blocking and muting it, the persona's follow requests, and search across the fediverse (a remote handle or URL is
+	/// resolved by PrivaPub, never by the browser). Lists come back empty and values null on failure; nothing throws.
+	/// </summary>
+	public class AccountService(IHttpService httpService, ILoggingService logger, CoalescingStringLocalizer localizer)
+	{
+		const int PageSize = 20;
+
+		public async Task<Account> Get(string accountId, CancellationToken cancellationToken = default)
+		{
+			using var response = await httpService.Get(APIs.Mastodon.GET_M_Account(accountId), cancellationToken: cancellationToken);
+			if (response.IsSuccessStatusCode)
+				return await response.MastodonReadFromJsonAsync<Account>(cancellationToken);
+
+			await LogFailure(response, nameof(Get), cancellationToken);
+			return null;
+		}
+
+		/// <summary>An account by its handle (name or name@host), resolved by PrivaPub if it has not met it yet.</summary>
+		public async Task<Account> Lookup(string acct, CancellationToken cancellationToken = default)
+		{
+			acct = acct?.Trim().TrimStart('@');
+			if (string.IsNullOrEmpty(acct))
+				return null;
+			using var response = await httpService.Get(APIs.Mastodon.GET_AccountLookup, [$"acct={Uri.EscapeDataString(acct)}"],
+				cancellationToken: cancellationToken);
+			if (response.IsSuccessStatusCode)
+				return await response.MastodonReadFromJsonAsync<Account>(cancellationToken);
+
+			var found = await Search(acct, resolve: true, cancellationToken);
+			return found.Accounts.FirstOrDefault(a => string.Equals(a.Acct, acct, StringComparison.OrdinalIgnoreCase))
+				?? found.Accounts.FirstOrDefault();
+		}
+
+		public async Task<Relationship> Relationship(string accountId, CancellationToken cancellationToken = default)
+		{
+			using var response = await httpService.Get(APIs.Mastodon.GET_Relationships, [$"id[]={Uri.EscapeDataString(accountId)}"],
+				cancellationToken: cancellationToken);
+			if (response.IsSuccessStatusCode)
+				return (await response.MastodonReadFromJsonAsync<List<Relationship>>(cancellationToken) ?? []).FirstOrDefault();
+
+			await LogFailure(response, nameof(Relationship), cancellationToken);
+			return null;
+		}
+
+		/// <summary>Follows, unfollows, blocks, unblocks, mutes or unmutes; Data is the new Relationship.</summary>
+		public async Task<WebResult> Act(string accountId, AccountAction action, CancellationToken cancellationToken = default)
+		{
+			using var response = await httpService.Post(APIs.Mastodon.POST_M_AccountAction(accountId, action.ToString().ToLowerInvariant()),
+				cancellationToken: cancellationToken);
+			if (!response.IsSuccessStatusCode)
+				return await response.Content.ReadWebResult(response.StatusCode, localizer, cancellationToken);
+
+			return new WebResult { Data = await response.MastodonReadFromJsonAsync<Relationship>(cancellationToken) };
+		}
+
+		/// <summary>A page of the account's posts, newest first; Data is a FeedPage.</summary>
+		public async Task<WebResult> Statuses(string accountId, ProfileTab tab, string maxId, CancellationToken cancellationToken = default)
+		{
+			var parameters = new List<string> { $"limit={PageSize}" };
+			parameters.AddRange(tab switch
+			{
+				ProfileTab.Posts => ["exclude_replies=true"],
+				ProfileTab.Media => ["only_media=true"],
+				_ => Array.Empty<string>()
+			});
+			if (maxId is not null)
+				parameters.Add($"max_id={Uri.EscapeDataString(maxId)}");
+			using var response = await httpService.Get(APIs.Mastodon.GET_M_AccountStatuses(accountId), [.. parameters],
+				cancellationToken: cancellationToken);
+			if (!response.IsSuccessStatusCode)
+				return await response.Content.ReadWebResult(response.StatusCode, localizer, cancellationToken);
+
+			var statuses = await response.MastodonReadFromJsonAsync<List<Status>>(cancellationToken) ?? [];
+			var (nextMaxId, _) = response.PageCursors();
+			return new WebResult
+			{
+				Data = new FeedPage
+				{
+					Posts = [.. statuses.Select(FeedPost.Of)],
+					MaxId = statuses.Count < PageSize ? null : nextMaxId ?? statuses.LastOrDefault()?.Id
+				}
+			};
+		}
+
+		/// <summary>The accounts waiting for the persona to accept their follow.</summary>
+		public async Task<List<Account>> FollowRequests(CancellationToken cancellationToken = default)
+		{
+			using var response = await httpService.Get(APIs.Mastodon.GET_FollowRequests, ["limit=80"], cancellationToken: cancellationToken);
+			if (response.IsSuccessStatusCode)
+				return await response.MastodonReadFromJsonAsync<List<Account>>(cancellationToken) ?? [];
+
+			await LogFailure(response, nameof(FollowRequests), cancellationToken);
+			return [];
+		}
+
+		/// <summary>Accepts (authorize) or refuses (reject) a follow request.</summary>
+		public async Task<WebResult> Answer(string accountId, bool accept, CancellationToken cancellationToken = default)
+		{
+			using var response = await httpService.Post(APIs.Mastodon.POST_M_FollowRequest(accountId, accept ? "authorize" : "reject"),
+				cancellationToken: cancellationToken);
+			if (!response.IsSuccessStatusCode)
+				return await response.Content.ReadWebResult(response.StatusCode, localizer, cancellationToken);
+
+			return new WebResult { Data = await response.MastodonReadFromJsonAsync<Relationship>(cancellationToken) };
+		}
+
+		/// <summary>Accounts, posts and hashtags matching the query; a handle or a URL is resolved when `resolve`.</summary>
+		public async Task<SearchResults> Search(string query, bool resolve, CancellationToken cancellationToken = default)
+		{
+			if (string.IsNullOrWhiteSpace(query))
+				return new SearchResults();
+			using var response = await httpService.Get(APIs.Mastodon.GET_Search,
+				[$"q={Uri.EscapeDataString(query.Trim())}", $"resolve={(resolve ? "true" : "false")}", "limit=20"],
+				cancellationToken: cancellationToken);
+			if (response.IsSuccessStatusCode)
+				return await response.MastodonReadFromJsonAsync<SearchResults>(cancellationToken) ?? new SearchResults();
+
+			await LogFailure(response, nameof(Search), cancellationToken);
+			return new SearchResults();
+		}
+
+		async Task LogFailure(HttpResponseMessage response, string caller, CancellationToken cancellationToken)
+		{
+			var result = await response.Content.ReadWebResult(response.StatusCode, localizer, cancellationToken);
+			if (result.StatusCode is not ((int)HttpStatusCode.Gone or (int)HttpStatusCode.NotFound))
+				await logger.ProcessWarning(result.ToString(localizer), $"{nameof(AccountService)}.{caller}", cancellationToken);
+		}
+	}
+}

Services/IHttpService.cs

@@ -37,6 +37,8 @@ namespace decePubClient.Services
 
 		Task<HttpResponseMessage> PostAnon(string uri, object payload = default, bool retryOnError = false, CancellationToken cancellationToken = default);
 
+		Task<HttpResponseMessage> Put(string uri, object payload = default, bool retryOnError = false, CancellationToken cancellationToken = default);
+
 		Task<HttpResponseMessage> PostTotallyAnon(string uri, object payload = default, bool retryOnError = false,
 			CancellationToken cancellationToken = default);
 
@@ -78,6 +80,9 @@ namespace decePubClient.Services
 		public Task<HttpResponseMessage> Post(string uri, object payload = default, bool retryOnError = false, CancellationToken cancellationToken = default) =>
 			Send(nameof(Post), () => BuildRequest(HttpMethod.Post, uri, payload, forceContent: true), SendAuthRequest, retryOnError, cancellationToken);
 
+		public Task<HttpResponseMessage> Put(string uri, object payload = default, bool retryOnError = false, CancellationToken cancellationToken = default) =>
+			Send(nameof(Put), () => BuildRequest(HttpMethod.Put, uri, payload, forceContent: true), SendAuthRequest, retryOnError, cancellationToken);
+
 		public Task<HttpResponseMessage> PostAnon(string uri, object payload = default, bool retryOnError = false, CancellationToken cancellationToken = default) =>
 			Send(nameof(PostAnon), () => BuildRequest(HttpMethod.Post, uri, payload, forceContent: true), SendAuthIfAvailableRequest, retryOnError,
 				cancellationToken);

Services/PublicNoticeService.cs

@@ -0,0 +1,43 @@
+using Blazored.LocalStorage;
+
+using decePubClient.Models;
+
+namespace decePubClient.Services
+{
+	/// <summary>
+	/// Asks a persona, once, before its first reaction or poll vote, to accept that these are public and visible as that
+	/// persona (an owner decision). PublicNoticeHost shows the question; Confirm returns true at once for a persona that
+	/// already accepted it, and false when the reader declines.
+	/// </summary>
+	public class PublicNoticeService(ILocalStorageService localStorage)
+	{
+		TaskCompletionSource<bool> pending;
+
+		public event Action Changed;
+
+		public bool IsAsking => pending is not null;
+
+		public async Task<bool> Confirm(string personaId, CancellationToken cancellationToken = default)
+		{
+			if (string.IsNullOrEmpty(personaId))
+				return false;
+			var seen = await localStorage.GetItemAsync<PublicActionNotices>(nameof(PublicActionNotices), cancellationToken) ?? new();
+			if (seen.PersonaIds.Contains(personaId))
+				return true;
+
+			pending = new TaskCompletionSource<bool>();
+			Changed?.Invoke();
+			var accepted = await pending.Task;
+			pending = null;
+			Changed?.Invoke();
+			if (!accepted)
+				return false;
+
+			seen.PersonaIds.Add(personaId);
+			await localStorage.SetItemAsync(nameof(PublicActionNotices), seen, cancellationToken);
+			return true;
+		}
+
+		public void Answer(bool accepted) => pending?.TrySetResult(accepted);
+	}
+}

Services/StatusService.cs

@@ -100,6 +100,27 @@ namespace decePubClient.Services
 			return await StatusResult(response, cancellationToken);
 		}
 
+		/// <summary>Reacts with an emoji (or takes the reaction back); Data is the updated Status.</summary>
+		public async Task<WebResult> React(string statusId, string emoji, bool add, CancellationToken cancellationToken = default)
+		{
+			var route = APIs.Mastodon.M_Reaction(statusId, emoji);
+			using var response = add
+				? await httpService.Put(route, cancellationToken: cancellationToken)
+				: await httpService.Delete(route, cancellationToken: cancellationToken);
+			return await StatusResult(response, cancellationToken);
+		}
+
+		/// <summary>Votes in a poll as the persona (each option by its index); Data is the updated Poll.</summary>
+		public async Task<WebResult> Vote(string pollId, IReadOnlyCollection<int> choices, CancellationToken cancellationToken = default)
+		{
+			using var response = await httpService.Post(APIs.Mastodon.POST_M_PollVotes(pollId), new PollVoteForm { Choices = [.. choices] },
+				cancellationToken: cancellationToken);
+			if (!response.IsSuccessStatusCode)
+				return await response.Content.ReadWebResult(response.StatusCode, localizer, cancellationToken);
+
+			return new WebResult { Data = await response.MastodonReadFromJsonAsync<Poll>(cancellationToken) };
+		}
+
 		/// <summary>Deletes the persona's own status.</summary>
 		public async Task<WebResult> Delete(string statusId, CancellationToken cancellationToken = default)
 		{