+1

.adonisjs/server/controllers.ts

reviewed

··· 6 6 export const controllers = { 7 7 Engagement: () => import('#controllers/engagement_controller'), 8 8 FeedGenerator: () => import('#controllers/feed_generator_controller'), 9 9 + Follow: () => import('#controllers/follow_controller'), 9 10 HealthChecks: () => import('#controllers/health_checks_controller'), 10 11 Landing: () => import('#controllers/landing_controller'), 11 12 Oauth: () => import('#controllers/oauth_controller'),

+4

.adonisjs/server/routes.d.ts

reviewed

··· 20 20 'api.like.delete': { paramsTuple?: []; params?: {} } 21 21 'api.repost.create': { paramsTuple?: []; params?: {} } 22 22 'api.repost.delete': { paramsTuple?: []; params?: {} } 23 23 + 'api.follow.create': { paramsTuple?: []; params?: {} } 24 24 + 'api.follow.delete': { paramsTuple?: []; params?: {} } 23 25 'og.landing': { paramsTuple?: []; params?: {} } 24 26 'og.profile': { paramsTuple: [ParamValue]; params: {'handle': ParamValue} } 25 27 'sitemap.index': { paramsTuple?: []; params?: {} } ··· 78 80 'oauth.logout': { paramsTuple?: []; params?: {} } 79 81 'api.like.create': { paramsTuple?: []; params?: {} } 80 82 'api.repost.create': { paramsTuple?: []; params?: {} } 83 83 + 'api.follow.create': { paramsTuple?: []; params?: {} } 81 84 } 82 85 DELETE: { 83 86 'api.like.delete': { paramsTuple?: []; params?: {} } 84 87 'api.repost.delete': { paramsTuple?: []; params?: {} } 88 88 + 'api.follow.delete': { paramsTuple?: []; params?: {} } 85 89 } 86 90 } 87 91 declare module '@adonisjs/core/types/http' {

+62

app/controllers/follow_controller.ts

reviewed

··· 1 1 + import { inject } from '@adonisjs/core' 2 2 + import type { HttpContext } from '@adonisjs/core/http' 3 3 + import vine from '@vinejs/vine' 4 4 + import AtprotoOAuthService from '#services/atproto_oauth' 5 5 + import { getPostHogClient } from '#services/posthog' 6 6 + 7 7 + const createValidator = vine.compile( 8 8 + vine.object({ 9 9 + did: vine.string().trim().minLength(1), 10 10 + }) 11 11 + ) 12 12 + 13 13 + const deleteValidator = vine.compile( 14 14 + vine.object({ 15 15 + uri: vine.string().trim().minLength(1), 16 16 + }) 17 17 + ) 18 18 + 19 19 + @inject() 20 20 + export default class FollowController { 21 21 + constructor(private readonly oauthService: AtprotoOAuthService) {} 22 22 + 23 23 + async follow({ request, auth, response }: HttpContext) { 24 24 + const { did } = await request.validateUsing(createValidator) 25 25 + const viewerDid = auth.use('web').user!.did 26 26 + 27 27 + if (did === viewerDid) { 28 28 + return response.status(400).json({ message: "You can't follow yourself." }) 29 29 + } 30 30 + 31 31 + try { 32 32 + const agent = await this.oauthService.getAgent(viewerDid) 33 33 + const result = await agent.follow(did) 34 34 + getPostHogClient()?.capture({ 35 35 + distinctId: viewerDid, 36 36 + event: 'follow_created', 37 37 + properties: { target_did: did }, 38 38 + }) 39 39 + return response.json({ uri: result.uri }) 40 40 + } catch (error) { 41 41 + return response.status(502).json({ message: 'Failed to create follow on Bluesky' }) 42 42 + } 43 43 + } 44 44 + 45 45 + async unfollow({ request, auth, response }: HttpContext) { 46 46 + const { uri } = await request.validateUsing(deleteValidator) 47 47 + const viewerDid = auth.use('web').user!.did 48 48 + 49 49 + try { 50 50 + const agent = await this.oauthService.getAgent(viewerDid) 51 51 + await agent.deleteFollow(uri) 52 52 + getPostHogClient()?.capture({ 53 53 + distinctId: viewerDid, 54 54 + event: 'follow_removed', 55 55 + properties: { follow_uri: uri }, 56 56 + }) 57 57 + return response.json({}) 58 58 + } catch (error) { 59 59 + return response.status(502).json({ message: 'Failed to delete follow on Bluesky' }) 60 60 + } 61 61 + } 62 62 + }

+30 -5

app/controllers/profile_controller.ts

reviewed

··· 341 341 // TODO: re-enable once PDS'es support granular rpc scopes. 342 342 let viewer: Record<string, { likeUri: string | null; repostUri: string | null }> | null = null 343 343 const cidMap = new Map<string, string>() 344 344 + const viewerDid = isAuthenticated ? ctx.auth.user!.did : null 345 345 + const isOwnProfile = viewerDid === user.did 346 346 + let viewerFollowUri: string | null = null 344 347 345 348 if (isAuthenticated) { 346 346 - const viewerDid = ctx.auth.user!.did 347 347 - const agent = await this.atprotoOAuthService.getAgent(viewerDid) 349 349 + const agent = await this.atprotoOAuthService.getAgent(viewerDid!) 348 350 const postUris = posts.map((p) => p.postUri) 349 349 - if (postUris.length > 0) { 350 350 - const res = await agent.app.bsky.feed.getPosts({ uris: postUris }) 351 351 + 352 352 + const fetchViewerProfile = async () => { 353 353 + if (isOwnProfile) return null 354 354 + try { 355 355 + return await agent.app.bsky.actor.getProfile({ actor: user.did }) 356 356 + } catch (err) { 357 357 + logger.error({ err, targetDid: user.did }, 'Failed to fetch viewer follow state') 358 358 + return null 359 359 + } 360 360 + } 361 361 + 362 362 + const [postsResult, profileResult] = await Promise.all([ 363 363 + postUris.length > 0 ? agent.app.bsky.feed.getPosts({ uris: postUris }) : null, 364 364 + fetchViewerProfile(), 365 365 + ]) 366 366 + 367 367 + if (postsResult) { 351 368 viewer = {} 352 352 - for (const post of res.data.posts) { 369 369 + for (const post of postsResult.data.posts) { 353 370 viewer[post.uri] = { 354 371 likeUri: post.viewer?.like ?? null, 355 372 repostUri: post.viewer?.repost ?? null, ··· 357 374 cidMap.set(post.uri, post.cid) 358 375 } 359 376 } 377 377 + 378 378 + if (profileResult) { 379 379 + viewerFollowUri = 380 380 + (profileResult.data.viewer as { following?: string } | undefined)?.following ?? null 381 381 + } 360 382 } 361 383 362 384 // 7. Add bsky.app URL and postCid to each post ··· 384 406 response.header('Vary', 'Cookie') 385 407 return view.render('pages/profile/show', { 386 408 handle: canonicalHandle, 409 409 + profileDid: user.did, 387 410 displayName: profile.displayName, 388 411 avatarUrl: profile.avatarUrl, 389 412 kind, ··· 395 418 ogImageUrl, 396 419 indexedSince, 397 420 viewer, 421 421 + isOwnProfile, 422 422 + viewerFollowUri, 398 423 }) 399 424 } 400 425

+118

resources/js/app.js

reviewed

··· 302 302 } 303 303 }) 304 304 305 305 + Alpine.data('profileFollow', function () { 306 306 + return { 307 307 + following: false, 308 308 + followUri: null, 309 309 + targetDid: '', 310 310 + csrfToken: '', 311 311 + busy: false, 312 312 + hovered: false, 313 313 + 314 314 + init() { 315 315 + this.following = this.$el.dataset.following === 'true' 316 316 + this.followUri = this.$el.dataset.followUri || null 317 317 + this.targetDid = this.$el.dataset.targetDid || '' 318 318 + var meta = document.querySelector('meta[name="csrf-token"]') 319 319 + this.csrfToken = meta ? meta.getAttribute('content') : '' 320 320 + }, 321 321 + 322 322 + onEnter() { 323 323 + this.hovered = true 324 324 + }, 325 325 + 326 326 + onLeave() { 327 327 + this.hovered = false 328 328 + }, 329 329 + 330 330 + toggle() { 331 331 + if (this.busy) return 332 332 + this.busy = true 333 333 + 334 334 + if (this.following) { 335 335 + var uri = this.followUri 336 336 + this.following = false 337 337 + this.followUri = null 338 338 + 339 339 + fetch('/api/follow', { 340 340 + method: 'DELETE', 341 341 + headers: { 342 342 + 'Content-Type': 'application/json', 343 343 + 'Accept': 'application/json', 344 344 + 'x-csrf-token': this.csrfToken, 345 345 + }, 346 346 + body: JSON.stringify({ uri: uri }), 347 347 + }) 348 348 + .then( 349 349 + function (resp) { 350 350 + if (!resp.ok) { 351 351 + this.following = true 352 352 + this.followUri = uri 353 353 + } 354 354 + }.bind(this) 355 355 + ) 356 356 + .catch( 357 357 + function () { 358 358 + this.following = true 359 359 + this.followUri = uri 360 360 + }.bind(this) 361 361 + ) 362 362 + .finally( 363 363 + function () { 364 364 + this.busy = false 365 365 + }.bind(this) 366 366 + ) 367 367 + } else { 368 368 + this.following = true 369 369 + 370 370 + fetch('/api/follow', { 371 371 + method: 'POST', 372 372 + headers: { 373 373 + 'Content-Type': 'application/json', 374 374 + 'Accept': 'application/json', 375 375 + 'x-csrf-token': this.csrfToken, 376 376 + }, 377 377 + body: JSON.stringify({ did: this.targetDid }), 378 378 + }) 379 379 + .then( 380 380 + function (resp) { 381 381 + if (resp.ok) { 382 382 + return resp.json() 383 383 + } 384 384 + this.following = false 385 385 + return null 386 386 + }.bind(this) 387 387 + ) 388 388 + .then( 389 389 + function (data) { 390 390 + if (data && data.uri) { 391 391 + this.followUri = data.uri 392 392 + } 393 393 + }.bind(this) 394 394 + ) 395 395 + .catch( 396 396 + function () { 397 397 + this.following = false 398 398 + }.bind(this) 399 399 + ) 400 400 + .finally( 401 401 + function () { 402 402 + this.busy = false 403 403 + }.bind(this) 404 404 + ) 405 405 + } 406 406 + }, 407 407 + 408 408 + get label() { 409 409 + if (!this.following) return 'Follow' 410 410 + return this.hovered ? 'Unfollow' : 'Following' 411 411 + }, 412 412 + 413 413 + get buttonClass() { 414 414 + if (!this.following) return 'bg-blue-600 text-white hover:bg-blue-700' 415 415 + if (this.hovered) { 416 416 + return 'bg-red-50 dark:bg-red-950/40 text-red-600 dark:text-red-400 ring-1 ring-inset ring-red-300 dark:ring-red-900' 417 417 + } 418 418 + return 'bg-gray-200 dark:bg-gray-800 text-gray-900 dark:text-gray-100' 419 419 + }, 420 420 + } 421 421 + }) 422 422 + 305 423 Alpine.start() 306 424 307 425 tippy('[data-tippy-content]')

+38 -13

resources/views/pages/profile/show.edge

reviewed

··· 16 16 @slot('main') 17 17 <div class="pt-8 pb-4"> 18 18 {{-- Profile header --}} 19 19 - <a href="https://bsky.app/profile/{{ handle }}" target="_blank" rel="noopener" class="group flex items-center gap-4 no-underline mb-6"> 20 20 - @if(avatarUrl) 21 21 - <img src="{{ avatarUrl }}" alt="{{ '@' + handle }} avatar" class="size-14 rounded-full shrink-0 object-cover"> 22 22 - @else 23 23 - <div class="size-14 rounded-full bg-gray-300 dark:bg-gray-700 shrink-0 flex items-center justify-center text-xl text-gray-400">@</div> 24 24 - @endif 25 25 - <div> 26 26 - @if(displayName) 27 27 - <h1 class="font-heading text-xl font-bold group-hover:underline leading-tight">{{ displayName }}</h1> 28 28 - <div class="text-gray-600 dark:text-gray-400 group-hover:underline">{{ '@' + handle }}</div> 19 19 + <div class="flex items-center gap-4 mb-6"> 20 20 + <a href="https://bsky.app/profile/{{ handle }}" target="_blank" rel="noopener" class="group flex items-center gap-4 no-underline flex-1 min-w-0"> 21 21 + @if(avatarUrl) 22 22 + <img src="{{ avatarUrl }}" alt="{{ '@' + handle }} avatar" class="size-14 rounded-full shrink-0 object-cover"> 29 23 @else 30 30 - <h1 class="font-heading text-xl font-bold group-hover:underline leading-tight">{{ '@' + handle }}</h1> 24 24 + <div class="size-14 rounded-full bg-gray-300 dark:bg-gray-700 shrink-0 flex items-center justify-center text-xl text-gray-400">@</div> 31 25 @endif 32 32 - </div> 33 33 - </a> 26 26 + <div class="min-w-0"> 27 27 + @if(displayName) 28 28 + <h1 class="font-heading text-xl font-bold group-hover:underline leading-tight truncate">{{ displayName }}</h1> 29 29 + <div class="text-gray-600 dark:text-gray-400 group-hover:underline truncate">{{ '@' + handle }}</div> 30 30 + @else 31 31 + <h1 class="font-heading text-xl font-bold group-hover:underline leading-tight truncate">{{ '@' + handle }}</h1> 32 32 + @endif 33 33 + </div> 34 34 + </a> 35 35 + @if(auth && auth.isAuthenticated && !isOwnProfile) 36 36 + <div 37 37 + x-data="profileFollow" 38 38 + data-target-did="{{ profileDid }}" 39 39 + data-following="{{ viewerFollowUri ? 'true' : 'false' }}" 40 40 + data-follow-uri="{{ viewerFollowUri ? viewerFollowUri : '' }}" 41 41 + class="shrink-0" 42 42 + > 43 43 + <button 44 44 + x-on:click="toggle" 45 45 + x-on:mouseenter="onEnter" 46 46 + x-on:mouseleave="onLeave" 47 47 + x-on:focus="onEnter" 48 48 + x-on:blur="onLeave" 49 49 + x-bind:class="buttonClass" 50 50 + x-bind:disabled="busy" 51 51 + class="text-sm font-medium rounded-full px-4 py-1.5 min-w-[96px] transition-colors duration-150 cursor-pointer disabled:cursor-wait" 52 52 + aria-label="Follow" 53 53 + > 54 54 + <span x-text="label"></span> 55 55 + </button> 56 56 + </div> 57 57 + @endif 58 58 + </div> 34 59 35 60 {{-- Controls --}} 36 61 <div class="flex flex-wrap items-center gap-x-3 gap-y-2 mb-6">

+3

start/routes.ts

reviewed

··· 16 16 const ProfileController = () => import('#controllers/profile_controller') 17 17 const OAuthController = () => import('#controllers/oauth_controller') 18 18 const EngagementController = () => import('#controllers/engagement_controller') 19 19 + const FollowController = () => import('#controllers/follow_controller') 19 20 const HealthChecksController = () => import('#controllers/health_checks_controller') 20 21 const OgImageController = () => import('#controllers/og_image_controller') 21 22 const SitemapController = () => import('#controllers/sitemap_controller') ··· 83 84 router.delete('/like', [EngagementController, 'deleteLike']).as('api.like.delete') 84 85 router.post('/repost', [EngagementController, 'repost']).as('api.repost.create') 85 86 router.delete('/repost', [EngagementController, 'deleteRepost']).as('api.repost.delete') 87 87 + router.post('/follow', [FollowController, 'follow']).as('api.follow.create') 88 88 + router.delete('/follow', [FollowController, 'unfollow']).as('api.follow.delete') 86 89 }) 87 90 .prefix('/api') 88 91 .use(middleware.auth())

+89

tests/functional/follow.spec.ts

reviewed

··· 1 1 + /** 2 2 + * Functional tests for the follow API (/api/follow). 3 3 + * 4 4 + * We can't hit real Bluesky in tests, so we focus on: 5 5 + * - Auth guard (401 for unauthenticated requests) 6 6 + * - Input validation (422 for missing / invalid body) 7 7 + * - Self-follow rejection (400 — following yourself isn't meaningful) 8 8 + */ 9 9 + import { test } from '@japa/runner' 10 10 + import testUtils from '@adonisjs/core/services/test_utils' 11 11 + import Account from '#models/account' 12 12 + 13 13 + test.group('Follow API | auth guard', () => { 14 14 + test('POST /api/follow without auth returns 401', async ({ client }) => { 15 15 + const response = await client 16 16 + .post('/api/follow') 17 17 + .withCsrfToken() 18 18 + .header('Accept', 'application/json') 19 19 + .json({ did: 'did:plc:target123' }) 20 20 + response.assertStatus(401) 21 21 + }) 22 22 + 23 23 + test('DELETE /api/follow without auth returns 401', async ({ client }) => { 24 24 + const response = await client 25 25 + .delete('/api/follow') 26 26 + .withCsrfToken() 27 27 + .header('Accept', 'application/json') 28 28 + .json({ uri: 'at://did:plc:abc/app.bsky.graph.follow/xyz' }) 29 29 + response.assertStatus(401) 30 30 + }) 31 31 + }) 32 32 + 33 33 + test.group('Follow API | validation', (group) => { 34 34 + group.each.setup(() => testUtils.db().withGlobalTransaction()) 35 35 + 36 36 + test('POST /api/follow with missing body returns 422', async ({ client }) => { 37 37 + const account = await Account.create({ 38 38 + did: 'did:plc:followvalid1', 39 39 + handle: 'followvalid.bsky.social', 40 40 + sessionData: '{}', 41 41 + createdAt: Date.now(), 42 42 + updatedAt: Date.now(), 43 43 + }) 44 44 + 45 45 + const response = await client 46 46 + .post('/api/follow') 47 47 + .loginAs(account) 48 48 + .withCsrfToken() 49 49 + .header('Accept', 'application/json') 50 50 + .json({}) 51 51 + response.assertStatus(422) 52 52 + }) 53 53 + 54 54 + test('DELETE /api/follow with missing body returns 422', async ({ client }) => { 55 55 + const account = await Account.create({ 56 56 + did: 'did:plc:followvalid2', 57 57 + handle: 'followvalid2.bsky.social', 58 58 + sessionData: '{}', 59 59 + createdAt: Date.now(), 60 60 + updatedAt: Date.now(), 61 61 + }) 62 62 + 63 63 + const response = await client 64 64 + .delete('/api/follow') 65 65 + .loginAs(account) 66 66 + .withCsrfToken() 67 67 + .header('Accept', 'application/json') 68 68 + .json({}) 69 69 + response.assertStatus(422) 70 70 + }) 71 71 + 72 72 + test('POST /api/follow with own DID returns 400', async ({ client }) => { 73 73 + const account = await Account.create({ 74 74 + did: 'did:plc:selffollow', 75 75 + handle: 'selffollow.bsky.social', 76 76 + sessionData: '{}', 77 77 + createdAt: Date.now(), 78 78 + updatedAt: Date.now(), 79 79 + }) 80 80 + 81 81 + const response = await client 82 82 + .post('/api/follow') 83 83 + .loginAs(account) 84 84 + .withCsrfToken() 85 85 + .header('Accept', 'application/json') 86 86 + .json({ did: 'did:plc:selffollow' }) 87 87 + response.assertStatus(400) 88 88 + }) 89 89 + })

+200

tests/functional/profile_controller.spec.ts

reviewed

··· 709 709 assert.include(html, 'Secret post for followers') 710 710 assert.notInclude(html, 'Sign in to view') 711 711 }).skip(async () => !(await isClickHouseAvailable()), 'ClickHouse not available') 712 712 + 713 713 + // Follow button: rendered for authenticated viewers looking at someone else's profile 714 714 + test('profile page renders Follow button for authenticated viewer on other profile', async ({ 715 715 + client, 716 716 + assert, 717 717 + swap, 718 718 + }) => { 719 719 + swap(ClickHouseStore, store) 720 720 + swap(AtprotoClient, { 721 721 + async getProfile() { 722 722 + return { displayName: null, avatarUrl: null } 723 723 + }, 724 724 + } as unknown as AtprotoClient) 725 725 + swap(AtprotoOAuthService, { 726 726 + async getAgent() { 727 727 + return { 728 728 + app: { 729 729 + bsky: { 730 730 + feed: { 731 731 + async getPosts() { 732 732 + return { data: { posts: [] } } 733 733 + }, 734 734 + }, 735 735 + actor: { 736 736 + async getProfile() { 737 737 + return { data: { viewer: {} } } 738 738 + }, 739 739 + }, 740 740 + }, 741 741 + }, 742 742 + } 743 743 + }, 744 744 + } as unknown as AtprotoOAuthService) 745 745 + 746 746 + await TrackedProfile.create({ 747 747 + did: 'did:plc:followtarget001', 748 748 + handle: 'target.bsky.social', 749 749 + firstSeenAt: Date.now(), 750 750 + backfilledAt: Date.now(), 751 751 + }) 752 752 + 753 753 + const account = await Account.create({ 754 754 + did: 'did:plc:followviewer001', 755 755 + handle: 'followviewer.bsky.social', 756 756 + sessionData: '{}', 757 757 + createdAt: Date.now(), 758 758 + updatedAt: Date.now(), 759 759 + }) 760 760 + 761 761 + const response = await client.get('/profile/target.bsky.social/likes').loginAs(account) 762 762 + response.assertStatus(200) 763 763 + const html = response.text() 764 764 + assert.include(html, 'x-data="profileFollow"') 765 765 + assert.include(html, 'data-target-did="did:plc:followtarget001"') 766 766 + assert.include(html, 'data-following="false"') 767 767 + }).skip(async () => !(await isClickHouseAvailable()), 'ClickHouse not available') 768 768 + 769 769 + // Follow button: shows "following" state when viewer already follows the profile 770 770 + test('profile page marks Follow button as following when viewer already follows', async ({ 771 771 + client, 772 772 + assert, 773 773 + swap, 774 774 + }) => { 775 775 + swap(ClickHouseStore, store) 776 776 + swap(AtprotoClient, { 777 777 + async getProfile() { 778 778 + return { displayName: null, avatarUrl: null } 779 779 + }, 780 780 + } as unknown as AtprotoClient) 781 781 + swap(AtprotoOAuthService, { 782 782 + async getAgent() { 783 783 + return { 784 784 + app: { 785 785 + bsky: { 786 786 + feed: { 787 787 + async getPosts() { 788 788 + return { data: { posts: [] } } 789 789 + }, 790 790 + }, 791 791 + actor: { 792 792 + async getProfile() { 793 793 + return { 794 794 + data: { 795 795 + viewer: { 796 796 + following: 'at://did:plc:followviewer002/app.bsky.graph.follow/followrkey', 797 797 + }, 798 798 + }, 799 799 + } 800 800 + }, 801 801 + }, 802 802 + }, 803 803 + }, 804 804 + } 805 805 + }, 806 806 + } as unknown as AtprotoOAuthService) 807 807 + 808 808 + await TrackedProfile.create({ 809 809 + did: 'did:plc:followtarget002', 810 810 + handle: 'target2.bsky.social', 811 811 + firstSeenAt: Date.now(), 812 812 + backfilledAt: Date.now(), 813 813 + }) 814 814 + 815 815 + const account = await Account.create({ 816 816 + did: 'did:plc:followviewer002', 817 817 + handle: 'followviewer2.bsky.social', 818 818 + sessionData: '{}', 819 819 + createdAt: Date.now(), 820 820 + updatedAt: Date.now(), 821 821 + }) 822 822 + 823 823 + const response = await client.get('/profile/target2.bsky.social/likes').loginAs(account) 824 824 + response.assertStatus(200) 825 825 + const html = response.text() 826 826 + assert.include(html, 'data-following="true"') 827 827 + assert.include( 828 828 + html, 829 829 + 'data-follow-uri="at://did:plc:followviewer002/app.bsky.graph.follow/followrkey"' 830 830 + ) 831 831 + }).skip(async () => !(await isClickHouseAvailable()), 'ClickHouse not available') 832 832 + 833 833 + // Follow button: NOT rendered when viewing your own profile 834 834 + test('profile page does not render Follow button on own profile', async ({ 835 835 + client, 836 836 + assert, 837 837 + swap, 838 838 + }) => { 839 839 + swap(ClickHouseStore, store) 840 840 + swap(AtprotoClient, { 841 841 + async getProfile() { 842 842 + return { displayName: null, avatarUrl: null } 843 843 + }, 844 844 + } as unknown as AtprotoClient) 845 845 + swap(AtprotoOAuthService, { 846 846 + async getAgent() { 847 847 + return { 848 848 + app: { 849 849 + bsky: { 850 850 + feed: { 851 851 + async getPosts() { 852 852 + return { data: { posts: [] } } 853 853 + }, 854 854 + }, 855 855 + actor: { 856 856 + async getProfile() { 857 857 + throw new Error('should not be called for own profile') 858 858 + }, 859 859 + }, 860 860 + }, 861 861 + }, 862 862 + } 863 863 + }, 864 864 + } as unknown as AtprotoOAuthService) 865 865 + 866 866 + await TrackedProfile.create({ 867 867 + did: 'did:plc:ownprofile001', 868 868 + handle: 'ownprofile.bsky.social', 869 869 + firstSeenAt: Date.now(), 870 870 + backfilledAt: Date.now(), 871 871 + }) 872 872 + 873 873 + const account = await Account.create({ 874 874 + did: 'did:plc:ownprofile001', 875 875 + handle: 'ownprofile.bsky.social', 876 876 + sessionData: '{}', 877 877 + createdAt: Date.now(), 878 878 + updatedAt: Date.now(), 879 879 + }) 880 880 + 881 881 + const response = await client.get('/profile/ownprofile.bsky.social/likes').loginAs(account) 882 882 + response.assertStatus(200) 883 883 + const html = response.text() 884 884 + assert.notInclude(html, 'x-data="profileFollow"') 885 885 + }).skip(async () => !(await isClickHouseAvailable()), 'ClickHouse not available') 886 886 + 887 887 + // Follow button: NOT rendered for unauthenticated viewers 888 888 + test('profile page does not render Follow button for unauthenticated viewer', async ({ 889 889 + client, 890 890 + assert, 891 891 + swap, 892 892 + }) => { 893 893 + swap(ClickHouseStore, store) 894 894 + swap(AtprotoClient, { 895 895 + async getProfile() { 896 896 + return { displayName: null, avatarUrl: null } 897 897 + }, 898 898 + } as unknown as AtprotoClient) 899 899 + 900 900 + await TrackedProfile.create({ 901 901 + did: 'did:plc:anonview001', 902 902 + handle: 'anonview.bsky.social', 903 903 + firstSeenAt: Date.now(), 904 904 + backfilledAt: Date.now(), 905 905 + }) 906 906 + 907 907 + const response = await client.get('/profile/anonview.bsky.social/likes') 908 908 + response.assertStatus(200) 909 909 + const html = response.text() 910 910 + assert.notInclude(html, 'x-data="profileFollow"') 911 911 + }).skip(async () => !(await isClickHouseAvailable()), 'ClickHouse not available') 712 912 }) 713 913 714 914 // ---------------------------------------------------------------------------