Merge branch 'release/2.1.0' into 'stable'v2.1.0

Release/2.1.0

See merge request pleroma/pleroma!2927

13 files changed, 337 insertions, 214 deletions

diff --git a/test/plugs/admin_secret_authentication_plug_test.exs b/test/plugs/admin_secret_authentication_plug_test.exs
index 2e300ac0c..89df03c4b 100644
--- a/test/plugs/admin_secret_authentication_plug_test.exs
+++ b/test/plugs/admin_secret_authentication_plug_test.exs
@@ -4,9 +4,14 @@
 
 defmodule Pleroma.Plugs.AdminSecretAuthenticationPlugTest do
   use Pleroma.Web.ConnCase, async: true
+
+  import Mock
   import Pleroma.Factory
 
   alias Pleroma.Plugs.AdminSecretAuthenticationPlug
+  alias Pleroma.Plugs.OAuthScopesPlug
+  alias Pleroma.Plugs.PlugHelper
+  alias Pleroma.Plugs.RateLimiter
 
   test "does nothing if a user is assigned", %{conn: conn} do
     user = insert(:user)
@@ -23,7 +28,11 @@ defmodule Pleroma.Plugs.AdminSecretAuthenticationPlugTest do
   end
 
   describe "when secret set it assigns an admin user" do
-    clear_config([:admin_token])
+    setup do: clear_config([:admin_token])
+
+    setup_with_mocks([{RateLimiter, [:passthrough], []}]) do
+      :ok
+    end
 
     test "with `admin_token` query parameter", %{conn: conn} do
       Pleroma.Config.put(:admin_token, "password123")
@@ -33,12 +42,14 @@ defmodule Pleroma.Plugs.AdminSecretAuthenticationPlugTest do
         |> AdminSecretAuthenticationPlug.call(%{})
 
       refute conn.assigns[:user]
+      assert called(RateLimiter.call(conn, name: :authentication))
 
       conn =
         %{conn | params: %{"admin_token" => "password123"}}
         |> AdminSecretAuthenticationPlug.call(%{})
 
       assert conn.assigns[:user].is_admin
+      assert PlugHelper.plug_skipped?(conn, OAuthScopesPlug)
     end
 
     test "with `x-admin-token` HTTP header", %{conn: conn} do
@@ -50,6 +61,7 @@ defmodule Pleroma.Plugs.AdminSecretAuthenticationPlugTest do
         |> AdminSecretAuthenticationPlug.call(%{})
 
       refute conn.assigns[:user]
+      assert called(RateLimiter.call(conn, name: :authentication))
 
       conn =
         conn
@@ -57,6 +69,7 @@ defmodule Pleroma.Plugs.AdminSecretAuthenticationPlugTest do
         |> AdminSecretAuthenticationPlug.call(%{})
 
       assert conn.assigns[:user].is_admin
+      assert PlugHelper.plug_skipped?(conn, OAuthScopesPlug)
     end
   end
 end
diff --git a/test/plugs/authentication_plug_test.exs b/test/plugs/authentication_plug_test.exs
index 646bda9d3..777ae15ae 100644
--- a/test/plugs/authentication_plug_test.exs
+++ b/test/plugs/authentication_plug_test.exs
@@ -11,12 +11,13 @@ defmodule Pleroma.Plugs.AuthenticationPlugTest do
   alias Pleroma.User
 
   import ExUnit.CaptureLog
+  import Pleroma.Factory
 
   setup %{conn: conn} do
     user = %User{
       id: 1,
       name: "dude",
-      password_hash: Comeonin.Pbkdf2.hashpwsalt("guy")
+      password_hash: Pbkdf2.hash_pwd_salt("guy")
     }
 
     conn =
@@ -50,16 +51,42 @@ defmodule Pleroma.Plugs.AuthenticationPlugTest do
     assert PlugHelper.plug_skipped?(conn, OAuthScopesPlug)
   end
 
-  test "with a wrong password in the credentials, it does nothing", %{conn: conn} do
+  test "with a bcrypt hash, it updates to a pkbdf2 hash", %{conn: conn} do
+    user = insert(:user, password_hash: Bcrypt.hash_pwd_salt("123"))
+    assert "$2" <> _ = user.password_hash
+
     conn =
       conn
-      |> assign(:auth_credentials, %{password: "wrong"})
+      |> assign(:auth_user, user)
+      |> assign(:auth_credentials, %{password: "123"})
+      |> AuthenticationPlug.call(%{})
 
-    ret_conn =
+    assert conn.assigns.user.id == conn.assigns.auth_user.id
+    assert PlugHelper.plug_skipped?(conn, OAuthScopesPlug)
+
+    user = User.get_by_id(user.id)
+    assert "$pbkdf2" <> _ = user.password_hash
+  end
+
+  @tag :skip_on_mac
+  test "with a crypt hash, it updates to a pkbdf2 hash", %{conn: conn} do
+    user =
+      insert(:user,
+        password_hash:
+          "$6$9psBWV8gxkGOZWBz$PmfCycChoxeJ3GgGzwvhlgacb9mUoZ.KUXNCssekER4SJ7bOK53uXrHNb2e4i8yPFgSKyzaW9CcmrDXWIEMtD1"
+      )
+
+    conn =
       conn
+      |> assign(:auth_user, user)
+      |> assign(:auth_credentials, %{password: "password"})
       |> AuthenticationPlug.call(%{})
 
-    assert conn == ret_conn
+    assert conn.assigns.user.id == conn.assigns.auth_user.id
+    assert PlugHelper.plug_skipped?(conn, OAuthScopesPlug)
+
+    user = User.get_by_id(user.id)
+    assert "$pbkdf2" <> _ = user.password_hash
   end
 
   describe "checkpw/2" do
@@ -79,6 +106,13 @@ defmodule Pleroma.Plugs.AuthenticationPlugTest do
       assert AuthenticationPlug.checkpw("password", hash)
     end
 
+    test "check bcrypt hash" do
+      hash = "$2a$10$uyhC/R/zoE1ndwwCtMusK.TLVzkQ/Ugsbqp3uXI.CTTz0gBw.24jS"
+
+      assert AuthenticationPlug.checkpw("password", hash)
+      refute AuthenticationPlug.checkpw("password1", hash)
+    end
+
     test "it returns false when hash invalid" do
       hash =
         "psBWV8gxkGOZWBz$PmfCycChoxeJ3GgGzwvhlgacb9mUoZ.KUXNCssekER4SJ7bOK53uXrHNb2e4i8yPFgSKyzaW9CcmrDXWIEMtD1"
diff --git a/test/plugs/ensure_authenticated_plug_test.exs b/test/plugs/ensure_authenticated_plug_test.exs
index 18be5edd0..a0667c5e0 100644
--- a/test/plugs/ensure_authenticated_plug_test.exs
+++ b/test/plugs/ensure_authenticated_plug_test.exs
@@ -8,24 +8,89 @@ defmodule Pleroma.Plugs.EnsureAuthenticatedPlugTest do
   alias Pleroma.Plugs.EnsureAuthenticatedPlug
   alias Pleroma.User
 
-  test "it halts if no user is assigned", %{conn: conn} do
+  describe "without :if_func / :unless_func options" do
+    test "it halts if user is NOT assigned", %{conn: conn} do
+      conn = EnsureAuthenticatedPlug.call(conn, %{})
+
+      assert conn.status == 403
+      assert conn.halted == true
+    end
+
+    test "it continues if a user is assigned", %{conn: conn} do
+      conn = assign(conn, :user, %User{})
+      ret_conn = EnsureAuthenticatedPlug.call(conn, %{})
+
+      refute ret_conn.halted
+    end
+  end
+
+  test "it halts if user is assigned and MFA enabled", %{conn: conn} do
     conn =
       conn
+      |> assign(:user, %User{multi_factor_authentication_settings: %{enabled: true}})
+      |> assign(:auth_credentials, %{password: "xd-42"})
       |> EnsureAuthenticatedPlug.call(%{})
 
     assert conn.status == 403
     assert conn.halted == true
+
+    assert conn.resp_body ==
+             "{\"error\":\"Two-factor authentication enabled, you must use a access token.\"}"
   end
 
-  test "it continues if a user is assigned", %{conn: conn} do
+  test "it continues if user is assigned and MFA disabled", %{conn: conn} do
     conn =
       conn
-      |> assign(:user, %User{})
-
-    ret_conn =
-      conn
+      |> assign(:user, %User{multi_factor_authentication_settings: %{enabled: false}})
+      |> assign(:auth_credentials, %{password: "xd-42"})
       |> EnsureAuthenticatedPlug.call(%{})
 
-    assert ret_conn == conn
+    refute conn.status == 403
+    refute conn.halted
+  end
+
+  describe "with :if_func / :unless_func options" do
+    setup do
+      %{
+        true_fn: fn _conn -> true end,
+        false_fn: fn _conn -> false end
+      }
+    end
+
+    test "it continues if a user is assigned", %{conn: conn, true_fn: true_fn, false_fn: false_fn} do
+      conn = assign(conn, :user, %User{})
+      refute EnsureAuthenticatedPlug.call(conn, if_func: true_fn).halted
+      refute EnsureAuthenticatedPlug.call(conn, if_func: false_fn).halted
+      refute EnsureAuthenticatedPlug.call(conn, unless_func: true_fn).halted
+      refute EnsureAuthenticatedPlug.call(conn, unless_func: false_fn).halted
+    end
+
+    test "it continues if a user is NOT assigned but :if_func evaluates to `false`",
+         %{conn: conn, false_fn: false_fn} do
+      ret_conn = EnsureAuthenticatedPlug.call(conn, if_func: false_fn)
+      refute ret_conn.halted
+    end
+
+    test "it continues if a user is NOT assigned but :unless_func evaluates to `true`",
+         %{conn: conn, true_fn: true_fn} do
+      ret_conn = EnsureAuthenticatedPlug.call(conn, unless_func: true_fn)
+      refute ret_conn.halted
+    end
+
+    test "it halts if a user is NOT assigned and :if_func evaluates to `true`",
+         %{conn: conn, true_fn: true_fn} do
+      conn = EnsureAuthenticatedPlug.call(conn, if_func: true_fn)
+
+      assert conn.status == 403
+      assert conn.halted == true
+    end
+
+    test "it halts if a user is NOT assigned and :unless_func evaluates to `false`",
+         %{conn: conn, false_fn: false_fn} do
+      conn = EnsureAuthenticatedPlug.call(conn, unless_func: false_fn)
+
+      assert conn.status == 403
+      assert conn.halted == true
+    end
   end
 end
diff --git a/test/plugs/ensure_public_or_authenticated_plug_test.exs b/test/plugs/ensure_public_or_authenticated_plug_test.exs
index 3fcb4d372..fc2934369 100644
--- a/test/plugs/ensure_public_or_authenticated_plug_test.exs
+++ b/test/plugs/ensure_public_or_authenticated_plug_test.exs
@@ -9,7 +9,7 @@ defmodule Pleroma.Plugs.EnsurePublicOrAuthenticatedPlugTest do
   alias Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug
   alias Pleroma.User
 
-  clear_config([:instance, :public])
+  setup do: clear_config([:instance, :public])
 
   test "it halts if not public and no user is assigned", %{conn: conn} do
     Config.put([:instance, :public], false)
@@ -29,7 +29,7 @@ defmodule Pleroma.Plugs.EnsurePublicOrAuthenticatedPlugTest do
       conn
       |> EnsurePublicOrAuthenticatedPlug.call(%{})
 
-    assert ret_conn == conn
+    refute ret_conn.halted
   end
 
   test "it continues if a user is assigned, even if not public", %{conn: conn} do
@@ -43,6 +43,6 @@ defmodule Pleroma.Plugs.EnsurePublicOrAuthenticatedPlugTest do
       conn
       |> EnsurePublicOrAuthenticatedPlug.call(%{})
 
-    assert ret_conn == conn
+    refute ret_conn.halted
   end
 end
diff --git a/test/plugs/frontend_static_test.exs b/test/plugs/frontend_static_test.exs
new file mode 100644
index 000000000..6f4923048
--- /dev/null
+++ b/test/plugs/frontend_static_test.exs
@@ -0,0 +1,57 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.FrontendStaticPlugTest do
+  alias Pleroma.Plugs.FrontendStatic
+  use Pleroma.Web.ConnCase
+
+  @dir "test/tmp/instance_static"
+
+  setup do
+    File.mkdir_p!(@dir)
+    on_exit(fn -> File.rm_rf(@dir) end)
+  end
+
+  setup do: clear_config([:instance, :static_dir], @dir)
+
+  test "init will give a static plug config + the frontend type" do
+    opts =
+      [
+        at: "/admin",
+        frontend_type: :admin
+      ]
+      |> FrontendStatic.init()
+
+    assert opts[:at] == ["admin"]
+    assert opts[:frontend_type] == :admin
+  end
+
+  test "overrides existing static files", %{conn: conn} do
+    name = "pelmora"
+    ref = "uguu"
+
+    clear_config([:frontends, :primary], %{"name" => name, "ref" => ref})
+    path = "#{@dir}/frontends/#{name}/#{ref}"
+
+    File.mkdir_p!(path)
+    File.write!("#{path}/index.html", "from frontend plug")
+
+    index = get(conn, "/")
+    assert html_response(index, 200) == "from frontend plug"
+  end
+
+  test "overrides existing static files for the `pleroma/admin` path", %{conn: conn} do
+    name = "pelmora"
+    ref = "uguu"
+
+    clear_config([:frontends, :admin], %{"name" => name, "ref" => ref})
+    path = "#{@dir}/frontends/#{name}/#{ref}"
+
+    File.mkdir_p!(path)
+    File.write!("#{path}/index.html", "from frontend plug")
+
+    index = get(conn, "/pleroma/admin/")
+    assert html_response(index, 200) == "from frontend plug"
+  end
+end
diff --git a/test/plugs/http_security_plug_test.exs b/test/plugs/http_security_plug_test.exs
index 6ba2dfe85..2297e3dac 100644
--- a/test/plugs/http_security_plug_test.exs
+++ b/test/plugs/http_security_plug_test.exs
@@ -4,17 +4,12 @@
 
 defmodule Pleroma.Web.Plugs.HTTPSecurityPlugTest do
   use Pleroma.Web.ConnCase
+
   alias Pleroma.Config
   alias Plug.Conn
 
-  clear_config([:http_securiy, :enabled])
-  clear_config([:http_security, :sts])
-  clear_config([:http_security, :referrer_policy])
-
   describe "http security enabled" do
-    setup do
-      Config.put([:http_security, :enabled], true)
-    end
+    setup do: clear_config([:http_security, :enabled], true)
 
     test "it sends CSP headers when enabled", %{conn: conn} do
       conn = get(conn, "/api/v1/instance")
@@ -29,7 +24,7 @@ defmodule Pleroma.Web.Plugs.HTTPSecurityPlugTest do
     end
 
     test "it sends STS headers when enabled", %{conn: conn} do
-      Config.put([:http_security, :sts], true)
+      clear_config([:http_security, :sts], true)
 
       conn = get(conn, "/api/v1/instance")
 
@@ -38,7 +33,7 @@ defmodule Pleroma.Web.Plugs.HTTPSecurityPlugTest do
     end
 
     test "it does not send STS headers when disabled", %{conn: conn} do
-      Config.put([:http_security, :sts], false)
+      clear_config([:http_security, :sts], false)
 
       conn = get(conn, "/api/v1/instance")
 
@@ -47,23 +42,19 @@ defmodule Pleroma.Web.Plugs.HTTPSecurityPlugTest do
     end
 
     test "referrer-policy header reflects configured value", %{conn: conn} do
-      conn = get(conn, "/api/v1/instance")
+      resp = get(conn, "/api/v1/instance")
 
-      assert Conn.get_resp_header(conn, "referrer-policy") == ["same-origin"]
+      assert Conn.get_resp_header(resp, "referrer-policy") == ["same-origin"]
 
-      Config.put([:http_security, :referrer_policy], "no-referrer")
+      clear_config([:http_security, :referrer_policy], "no-referrer")
 
-      conn =
-        build_conn()
-        |> get("/api/v1/instance")
+      resp = get(conn, "/api/v1/instance")
 
-      assert Conn.get_resp_header(conn, "referrer-policy") == ["no-referrer"]
+      assert Conn.get_resp_header(resp, "referrer-policy") == ["no-referrer"]
     end
 
-    test "it sends `report-to` & `report-uri` CSP response headers" do
-      conn =
-        build_conn()
-        |> get("/api/v1/instance")
+    test "it sends `report-to` & `report-uri` CSP response headers", %{conn: conn} do
+      conn = get(conn, "/api/v1/instance")
 
       [csp] = Conn.get_resp_header(conn, "content-security-policy")
 
@@ -74,10 +65,67 @@ defmodule Pleroma.Web.Plugs.HTTPSecurityPlugTest do
       assert reply_to ==
                "{\"endpoints\":[{\"url\":\"https://endpoint.com\"}],\"group\":\"csp-endpoint\",\"max-age\":10886400}"
     end
+
+    test "default values for img-src and media-src with disabled media proxy", %{conn: conn} do
+      conn = get(conn, "/api/v1/instance")
+
+      [csp] = Conn.get_resp_header(conn, "content-security-policy")
+      assert csp =~ "media-src 'self' https:;"
+      assert csp =~ "img-src 'self' data: blob: https:;"
+    end
+  end
+
+  describe "img-src and media-src" do
+    setup do
+      clear_config([:http_security, :enabled], true)
+      clear_config([:media_proxy, :enabled], true)
+      clear_config([:media_proxy, :proxy_opts, :redirect_on_failure], false)
+    end
+
+    test "media_proxy with base_url", %{conn: conn} do
+      url = "https://example.com"
+      clear_config([:media_proxy, :base_url], url)
+      assert_media_img_src(conn, url)
+    end
+
+    test "upload with base url", %{conn: conn} do
+      url = "https://example2.com"
+      clear_config([Pleroma.Upload, :base_url], url)
+      assert_media_img_src(conn, url)
+    end
+
+    test "with S3 public endpoint", %{conn: conn} do
+      url = "https://example3.com"
+      clear_config([Pleroma.Uploaders.S3, :public_endpoint], url)
+      assert_media_img_src(conn, url)
+    end
+
+    test "with captcha endpoint", %{conn: conn} do
+      clear_config([Pleroma.Captcha.Mock, :endpoint], "https://captcha.com")
+      assert_media_img_src(conn, "https://captcha.com")
+    end
+
+    test "with media_proxy whitelist", %{conn: conn} do
+      clear_config([:media_proxy, :whitelist], ["https://example6.com", "https://example7.com"])
+      assert_media_img_src(conn, "https://example7.com https://example6.com")
+    end
+
+    # TODO: delete after removing support bare domains for media proxy whitelist
+    test "with media_proxy bare domains whitelist (deprecated)", %{conn: conn} do
+      clear_config([:media_proxy, :whitelist], ["example4.com", "example5.com"])
+      assert_media_img_src(conn, "example5.com example4.com")
+    end
+  end
+
+  defp assert_media_img_src(conn, url) do
+    conn = get(conn, "/api/v1/instance")
+    [csp] = Conn.get_resp_header(conn, "content-security-policy")
+    assert csp =~ "media-src 'self' #{url};"
+    assert csp =~ "img-src 'self' data: blob: #{url};"
   end
 
   test "it does not send CSP headers when disabled", %{conn: conn} do
-    Config.put([:http_security, :enabled], false)
+    clear_config([:http_security, :enabled], false)
 
     conn = get(conn, "/api/v1/instance")
 
diff --git a/test/plugs/instance_static_test.exs b/test/plugs/instance_static_test.exs
index 8cd9b5712..d42ba817e 100644
--- a/test/plugs/instance_static_test.exs
+++ b/test/plugs/instance_static_test.exs
@@ -2,7 +2,7 @@
 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
 # SPDX-License-Identifier: AGPL-3.0-only
 
-defmodule Pleroma.Web.RuntimeStaticPlugTest do
+defmodule Pleroma.Web.InstanceStaticPlugTest do
   use Pleroma.Web.ConnCase
 
   @dir "test/tmp/instance_static"
@@ -12,13 +12,11 @@ defmodule Pleroma.Web.RuntimeStaticPlugTest do
     on_exit(fn -> File.rm_rf(@dir) end)
   end
 
-  clear_config([:instance, :static_dir]) do
-    Pleroma.Config.put([:instance, :static_dir], @dir)
-  end
+  setup do: clear_config([:instance, :static_dir], @dir)
 
   test "overrides index" do
     bundled_index = get(build_conn(), "/")
-    assert html_response(bundled_index, 200) == File.read!("priv/static/index.html")
+    refute html_response(bundled_index, 200) == "hello world"
 
     File.write!(@dir <> "/index.html", "hello world")
 
@@ -26,6 +24,28 @@ defmodule Pleroma.Web.RuntimeStaticPlugTest do
     assert html_response(index, 200) == "hello world"
   end
 
+  test "also overrides frontend files", %{conn: conn} do
+    name = "pelmora"
+    ref = "uguu"
+
+    clear_config([:frontends, :primary], %{"name" => name, "ref" => ref})
+
+    bundled_index = get(conn, "/")
+    refute html_response(bundled_index, 200) == "from frontend plug"
+
+    path = "#{@dir}/frontends/#{name}/#{ref}"
+    File.mkdir_p!(path)
+    File.write!("#{path}/index.html", "from frontend plug")
+
+    index = get(conn, "/")
+    assert html_response(index, 200) == "from frontend plug"
+
+    File.write!(@dir <> "/index.html", "from instance static")
+
+    index = get(conn, "/")
+    assert html_response(index, 200) == "from instance static"
+  end
+
   test "overrides any file in static/static" do
     bundled_index = get(build_conn(), "/static/terms-of-service.html")
 
diff --git a/test/plugs/oauth_plug_test.exs b/test/plugs/oauth_plug_test.exs
index 8534a5c13..f74c068cd 100644
--- a/test/plugs/oauth_plug_test.exs
+++ b/test/plugs/oauth_plug_test.exs
@@ -38,7 +38,7 @@ defmodule Pleroma.Plugs.OAuthPlugTest do
     assert conn.assigns[:user] == opts[:user]
   end
 
-  test "with valid token(downcase) in url parameters, it assings the user", opts do
+  test "with valid token(downcase) in url parameters, it assigns the user", opts do
     conn =
       :get
       |> build_conn("/?access_token=#{opts[:token]}")
diff --git a/test/plugs/oauth_scopes_plug_test.exs b/test/plugs/oauth_scopes_plug_test.exs
index d855d4f54..884de7b4d 100644
--- a/test/plugs/oauth_scopes_plug_test.exs
+++ b/test/plugs/oauth_scopes_plug_test.exs
@@ -5,17 +5,12 @@
 defmodule Pleroma.Plugs.OAuthScopesPlugTest do
   use Pleroma.Web.ConnCase, async: true
 
-  alias Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug
   alias Pleroma.Plugs.OAuthScopesPlug
   alias Pleroma.Repo
 
   import Mock
   import Pleroma.Factory
 
-  setup_with_mocks([{EnsurePublicOrAuthenticatedPlug, [], [call: fn conn, _ -> conn end]}]) do
-    :ok
-  end
-
   test "is not performed if marked as skipped", %{conn: conn} do
     with_mock OAuthScopesPlug, [:passthrough], perform: &passthrough([&1, &2]) do
       conn =
@@ -60,7 +55,7 @@ defmodule Pleroma.Plugs.OAuthScopesPlugTest do
 
   describe "with `fallback: :proceed_unauthenticated` option, " do
     test "if `token.scopes` doesn't fulfill specified conditions, " <>
-           "clears :user and :token assigns and calls EnsurePublicOrAuthenticatedPlug",
+           "clears :user and :token assigns",
          %{conn: conn} do
       user = insert(:user)
       token1 = insert(:oauth_token, scopes: ["read", "write"], user: user)
@@ -79,35 +74,6 @@ defmodule Pleroma.Plugs.OAuthScopesPlugTest do
         refute ret_conn.halted
         refute ret_conn.assigns[:user]
         refute ret_conn.assigns[:token]
-
-        assert called(EnsurePublicOrAuthenticatedPlug.call(ret_conn, :_))
-      end
-    end
-
-    test "with :skip_instance_privacy_check option, " <>
-           "if `token.scopes` doesn't fulfill specified conditions, " <>
-           "clears :user and :token assigns and does NOT call EnsurePublicOrAuthenticatedPlug",
-         %{conn: conn} do
-      user = insert(:user)
-      token1 = insert(:oauth_token, scopes: ["read:statuses", "write"], user: user)
-
-      for token <- [token1, nil], op <- [:|, :&] do
-        ret_conn =
-          conn
-          |> assign(:user, user)
-          |> assign(:token, token)
-          |> OAuthScopesPlug.call(%{
-            scopes: ["read"],
-            op: op,
-            fallback: :proceed_unauthenticated,
-            skip_instance_privacy_check: true
-          })
-
-        refute ret_conn.halted
-        refute ret_conn.assigns[:user]
-        refute ret_conn.assigns[:token]
-
-        refute called(EnsurePublicOrAuthenticatedPlug.call(ret_conn, :_))
       end
     end
   end
@@ -205,7 +171,7 @@ defmodule Pleroma.Plugs.OAuthScopesPlugTest do
   end
 
   describe "transform_scopes/2" do
-    clear_config([:auth, :enforce_oauth_admin_scope_usage])
+    setup do: clear_config([:auth, :enforce_oauth_admin_scope_usage])
 
     setup do
       {:ok, %{f: &OAuthScopesPlug.transform_scopes/2}}
diff --git a/test/plugs/rate_limiter_test.exs b/test/plugs/rate_limiter_test.exs
index 81e2009c8..4d3d694f4 100644
--- a/test/plugs/rate_limiter_test.exs
+++ b/test/plugs/rate_limiter_test.exs
@@ -5,21 +5,21 @@
 defmodule Pleroma.Plugs.RateLimiterTest do
   use Pleroma.Web.ConnCase
 
+  alias Phoenix.ConnTest
   alias Pleroma.Config
   alias Pleroma.Plugs.RateLimiter
+  alias Plug.Conn
 
   import Pleroma.Factory
   import Pleroma.Tests.Helpers, only: [clear_config: 1, clear_config: 2]
 
   # Note: each example must work with separate buckets in order to prevent concurrency issues
-
-  clear_config([Pleroma.Web.Endpoint, :http, :ip])
-  clear_config(:rate_limit)
+  setup do: clear_config([Pleroma.Web.Endpoint, :http, :ip])
+  setup do: clear_config(:rate_limit)
 
   describe "config" do
     @limiter_name :test_init
-
-    clear_config([Pleroma.Plugs.RemoteIp, :enabled])
+    setup do: clear_config([Pleroma.Plugs.RemoteIp, :enabled])
 
     test "config is required for plug to work" do
       Config.put([:rate_limit, @limiter_name], {1, 1})
@@ -38,8 +38,15 @@ defmodule Pleroma.Plugs.RateLimiterTest do
   end
 
   test "it is disabled if it remote ip plug is enabled but no remote ip is found" do
-    Config.put([Pleroma.Web.Endpoint, :http, :ip], {127, 0, 0, 1})
-    assert RateLimiter.disabled?(Plug.Conn.assign(build_conn(), :remote_ip_found, false))
+    assert RateLimiter.disabled?(Conn.assign(build_conn(), :remote_ip_found, false))
+  end
+
+  test "it is enabled if remote ip found" do
+    refute RateLimiter.disabled?(Conn.assign(build_conn(), :remote_ip_found, true))
+  end
+
+  test "it is enabled if remote_ip_found flag doesn't exist" do
+    refute RateLimiter.disabled?(build_conn())
   end
 
   test "it restricts based on config values" do
@@ -51,7 +58,7 @@ defmodule Pleroma.Plugs.RateLimiterTest do
     Config.put([:rate_limit, limiter_name], {scale, limit})
 
     plug_opts = RateLimiter.init(name: limiter_name)
-    conn = conn(:get, "/")
+    conn = build_conn(:get, "/")
 
     for i <- 1..5 do
       conn = RateLimiter.call(conn, plug_opts)
@@ -60,17 +67,17 @@ defmodule Pleroma.Plugs.RateLimiterTest do
     end
 
     conn = RateLimiter.call(conn, plug_opts)
-    assert %{"error" => "Throttled"} = Phoenix.ConnTest.json_response(conn, :too_many_requests)
+    assert %{"error" => "Throttled"} = ConnTest.json_response(conn, :too_many_requests)
     assert conn.halted
 
     Process.sleep(50)
 
-    conn = conn(:get, "/")
+    conn = build_conn(:get, "/")
 
     conn = RateLimiter.call(conn, plug_opts)
     assert {1, 4} = RateLimiter.inspect_bucket(conn, limiter_name, plug_opts)
 
-    refute conn.status == Plug.Conn.Status.code(:too_many_requests)
+    refute conn.status == Conn.Status.code(:too_many_requests)
     refute conn.resp_body
     refute conn.halted
   end
@@ -85,7 +92,7 @@ defmodule Pleroma.Plugs.RateLimiterTest do
       base_bucket_name = "#{limiter_name}:group1"
       plug_opts = RateLimiter.init(name: limiter_name, bucket_name: base_bucket_name)
 
-      conn = conn(:get, "/")
+      conn = build_conn(:get, "/")
 
       RateLimiter.call(conn, plug_opts)
       assert {1, 4} = RateLimiter.inspect_bucket(conn, base_bucket_name, plug_opts)
@@ -99,9 +106,9 @@ defmodule Pleroma.Plugs.RateLimiterTest do
 
       plug_opts = RateLimiter.init(name: limiter_name, params: ["id"])
 
-      conn = conn(:get, "/?id=1")
-      conn = Plug.Conn.fetch_query_params(conn)
-      conn_2 = conn(:get, "/?id=2")
+      conn = build_conn(:get, "/?id=1")
+      conn = Conn.fetch_query_params(conn)
+      conn_2 = build_conn(:get, "/?id=2")
 
       RateLimiter.call(conn, plug_opts)
       assert {1, 4} = RateLimiter.inspect_bucket(conn, limiter_name, plug_opts)
@@ -120,9 +127,9 @@ defmodule Pleroma.Plugs.RateLimiterTest do
 
       id = "100"
 
-      conn = conn(:get, "/?id=#{id}")
-      conn = Plug.Conn.fetch_query_params(conn)
-      conn_2 = conn(:get, "/?id=#{101}")
+      conn = build_conn(:get, "/?id=#{id}")
+      conn = Conn.fetch_query_params(conn)
+      conn_2 = build_conn(:get, "/?id=#{101}")
 
       RateLimiter.call(conn, plug_opts)
       assert {1, 4} = RateLimiter.inspect_bucket(conn, base_bucket_name, plug_opts)
@@ -138,8 +145,8 @@ defmodule Pleroma.Plugs.RateLimiterTest do
 
       plug_opts = RateLimiter.init(name: limiter_name)
 
-      conn = %{conn(:get, "/") | remote_ip: {127, 0, 0, 2}}
-      conn_2 = %{conn(:get, "/") | remote_ip: {127, 0, 0, 3}}
+      conn = %{build_conn(:get, "/") | remote_ip: {127, 0, 0, 2}}
+      conn_2 = %{build_conn(:get, "/") | remote_ip: {127, 0, 0, 3}}
 
       for i <- 1..5 do
         conn = RateLimiter.call(conn, plug_opts)
@@ -149,13 +156,13 @@ defmodule Pleroma.Plugs.RateLimiterTest do
 
       conn = RateLimiter.call(conn, plug_opts)
 
-      assert %{"error" => "Throttled"} = Phoenix.ConnTest.json_response(conn, :too_many_requests)
+      assert %{"error" => "Throttled"} = ConnTest.json_response(conn, :too_many_requests)
       assert conn.halted
 
       conn_2 = RateLimiter.call(conn_2, plug_opts)
       assert {1, 4} = RateLimiter.inspect_bucket(conn_2, limiter_name, plug_opts)
 
-      refute conn_2.status == Plug.Conn.Status.code(:too_many_requests)
+      refute conn_2.status == Conn.Status.code(:too_many_requests)
       refute conn_2.resp_body
       refute conn_2.halted
     end
@@ -179,7 +186,7 @@ defmodule Pleroma.Plugs.RateLimiterTest do
       plug_opts = RateLimiter.init(name: limiter_name)
 
       user = insert(:user)
-      conn = conn(:get, "/") |> assign(:user, user)
+      conn = build_conn(:get, "/") |> assign(:user, user)
 
       for i <- 1..5 do
         conn = RateLimiter.call(conn, plug_opts)
@@ -189,7 +196,7 @@ defmodule Pleroma.Plugs.RateLimiterTest do
 
       conn = RateLimiter.call(conn, plug_opts)
 
-      assert %{"error" => "Throttled"} = Phoenix.ConnTest.json_response(conn, :too_many_requests)
+      assert %{"error" => "Throttled"} = ConnTest.json_response(conn, :too_many_requests)
       assert conn.halted
     end
 
@@ -201,10 +208,10 @@ defmodule Pleroma.Plugs.RateLimiterTest do
       plug_opts = RateLimiter.init(name: limiter_name)
 
       user = insert(:user)
-      conn = conn(:get, "/") |> assign(:user, user)
+      conn = build_conn(:get, "/") |> assign(:user, user)
 
       user_2 = insert(:user)
-      conn_2 = conn(:get, "/") |> assign(:user, user_2)
+      conn_2 = build_conn(:get, "/") |> assign(:user, user_2)
 
       for i <- 1..5 do
         conn = RateLimiter.call(conn, plug_opts)
@@ -212,12 +219,12 @@ defmodule Pleroma.Plugs.RateLimiterTest do
       end
 
       conn = RateLimiter.call(conn, plug_opts)
-      assert %{"error" => "Throttled"} = Phoenix.ConnTest.json_response(conn, :too_many_requests)
+      assert %{"error" => "Throttled"} = ConnTest.json_response(conn, :too_many_requests)
       assert conn.halted
 
       conn_2 = RateLimiter.call(conn_2, plug_opts)
       assert {1, 4} = RateLimiter.inspect_bucket(conn_2, limiter_name, plug_opts)
-      refute conn_2.status == Plug.Conn.Status.code(:too_many_requests)
+      refute conn_2.status == Conn.Status.code(:too_many_requests)
       refute conn_2.resp_body
       refute conn_2.halted
     end
@@ -230,8 +237,8 @@ defmodule Pleroma.Plugs.RateLimiterTest do
 
     opts = RateLimiter.init(name: limiter_name)
 
-    conn = conn(:get, "/")
-    conn_2 = conn(:get, "/")
+    conn = build_conn(:get, "/")
+    conn_2 = build_conn(:get, "/")
 
     %Task{pid: pid1} =
       task1 =
diff --git a/test/plugs/remote_ip_test.exs b/test/plugs/remote_ip_test.exs
index 9c3737b0b..752ab32e7 100644
--- a/test/plugs/remote_ip_test.exs
+++ b/test/plugs/remote_ip_test.exs
@@ -9,8 +9,7 @@ defmodule Pleroma.Plugs.RemoteIpTest do
   alias Pleroma.Plugs.RemoteIp
 
   import Pleroma.Tests.Helpers, only: [clear_config: 1, clear_config: 2]
-
-  clear_config(RemoteIp)
+  setup do: clear_config(RemoteIp)
 
   test "disabled" do
     Pleroma.Config.put(RemoteIp, enabled: false)
diff --git a/test/plugs/user_enabled_plug_test.exs b/test/plugs/user_enabled_plug_test.exs
index 931513d83..b219d8abf 100644
--- a/test/plugs/user_enabled_plug_test.exs
+++ b/test/plugs/user_enabled_plug_test.exs
@@ -8,7 +8,7 @@ defmodule Pleroma.Plugs.UserEnabledPlugTest do
   alias Pleroma.Plugs.UserEnabledPlug
   import Pleroma.Factory
 
-  clear_config([:instance, :account_activation_required])
+  setup do: clear_config([:instance, :account_activation_required])
 
   test "doesn't do anything if the user isn't set", %{conn: conn} do
     ret_conn =
diff --git a/test/plugs/user_is_admin_plug_test.exs b/test/plugs/user_is_admin_plug_test.exs
index 015d51018..8bc00e444 100644
--- a/test/plugs/user_is_admin_plug_test.exs
+++ b/test/plugs/user_is_admin_plug_test.exs
@@ -8,116 +8,30 @@ defmodule Pleroma.Plugs.UserIsAdminPlugTest do
   alias Pleroma.Plugs.UserIsAdminPlug
   import Pleroma.Factory
 
-  describe "unless [:auth, :enforce_oauth_admin_scope_usage]," do
-    clear_config([:auth, :enforce_oauth_admin_scope_usage]) do
-      Pleroma.Config.put([:auth, :enforce_oauth_admin_scope_usage], false)
-    end
+  test "accepts a user that is an admin" do
+    user = insert(:user, is_admin: true)
 
-    test "accepts a user that is an admin" do
-      user = insert(:user, is_admin: true)
+    conn = assign(build_conn(), :user, user)
 
-      conn = assign(build_conn(), :user, user)
+    ret_conn = UserIsAdminPlug.call(conn, %{})
 
-      ret_conn = UserIsAdminPlug.call(conn, %{})
-
-      assert conn == ret_conn
-    end
-
-    test "denies a user that isn't an admin" do
-      user = insert(:user)
-
-      conn =
-        build_conn()
-        |> assign(:user, user)
-        |> UserIsAdminPlug.call(%{})
-
-      assert conn.status == 403
-    end
-
-    test "denies when a user isn't set" do
-      conn = UserIsAdminPlug.call(build_conn(), %{})
-
-      assert conn.status == 403
-    end
+    assert conn == ret_conn
   end
 
-  describe "with [:auth, :enforce_oauth_admin_scope_usage]," do
-    clear_config([:auth, :enforce_oauth_admin_scope_usage]) do
-      Pleroma.Config.put([:auth, :enforce_oauth_admin_scope_usage], true)
-    end
-
-    setup do
-      admin_user = insert(:user, is_admin: true)
-      non_admin_user = insert(:user, is_admin: false)
-      blank_user = nil
-
-      {:ok, %{users: [admin_user, non_admin_user, blank_user]}}
-    end
-
-    test "if token has any of admin scopes, accepts a user that is an admin", %{conn: conn} do
-      user = insert(:user, is_admin: true)
-      token = insert(:oauth_token, user: user, scopes: ["admin:something"])
-
-      conn =
-        conn
-        |> assign(:user, user)
-        |> assign(:token, token)
+  test "denies a user that isn't an admin" do
+    user = insert(:user)
 
-      ret_conn = UserIsAdminPlug.call(conn, %{})
+    conn =
+      build_conn()
+      |> assign(:user, user)
+      |> UserIsAdminPlug.call(%{})
 
-      assert conn == ret_conn
-    end
-
-    test "if token has any of admin scopes, denies a user that isn't an admin", %{conn: conn} do
-      user = insert(:user, is_admin: false)
-      token = insert(:oauth_token, user: user, scopes: ["admin:something"])
-
-      conn =
-        conn
-        |> assign(:user, user)
-        |> assign(:token, token)
-        |> UserIsAdminPlug.call(%{})
-
-      assert conn.status == 403
-    end
-
-    test "if token has any of admin scopes, denies when a user isn't set", %{conn: conn} do
-      token = insert(:oauth_token, scopes: ["admin:something"])
-
-      conn =
-        conn
-        |> assign(:user, nil)
-        |> assign(:token, token)
-        |> UserIsAdminPlug.call(%{})
-
-      assert conn.status == 403
-    end
-
-    test "if token lacks admin scopes, denies users regardless of is_admin flag",
-         %{users: users} do
-      for user <- users do
-        token = insert(:oauth_token, user: user)
-
-        conn =
-          build_conn()
-          |> assign(:user, user)
-          |> assign(:token, token)
-          |> UserIsAdminPlug.call(%{})
-
-        assert conn.status == 403
-      end
-    end
+    assert conn.status == 403
+  end
 
-    test "if token is missing, denies users regardless of is_admin flag", %{users: users} do
-      for user <- users do
-        conn =
-          build_conn()
-          |> assign(:user, user)
-          |> assign(:token, nil)
-          |> UserIsAdminPlug.call(%{})
+  test "denies when a user isn't set" do
+    conn = UserIsAdminPlug.call(build_conn(), %{})
 
-        assert conn.status == 403
-      end
-    end
+    assert conn.status == 403
   end
 end