Update package version to 1.17.11

| datasource      | package            | from  | to     |
| --------------- | ------------------ | ----- | ------ |
| github-releases | tootsuite/mastodon | 4.5.9 | 4.5.10 |

.gitignore

@@ -1,3 +1,4 @@
 node_modules
 mastodon
 .idea
+tmp/

CHANGELOG

@@ -865,3 +865,15 @@
 * Fix being unable to disable sound for quote update notification ([#38537](https://github.com/tootsuite/mastodon/issues/38537) by [@ClearlyClaire](https://github.com/ClearlyClaire))
 * Fix being able to quote someone you blocked ([#38608](https://github.com/tootsuite/mastodon/issues/38608) by [@ClearlyClaire](https://github.com/ClearlyClaire))
 
+[1.17.10]
+* fix: update doc links from /apps/ to /packages/
+
+[1.17.11]
+* Update mastodon to 4.5.10
+* [Full Changelog](https://github.com/mastodon/mastodon/releases/tag/v4.5.10)
+* Fix SSRF protection bypass ([GHSA-crr4-7rm4-8gpw](https://github.com/mastodon/mastodon/security/advisories/GHSA-crr4-7rm4-8gpw), [GHSA-xx55-4rrg-8xg6](https://github.com/mastodon/mastodon/security/advisories/GHSA-xx55-4rrg-8xg6))
+* Fix Linked-Data Signature bypass through JSON-LD graph restructuring features ([GHSA-53m7-2wrh-q839](https://github.com/mastodon/mastodon/security/advisories/GHSA-53m7-2wrh-q839), [GHSA-chgx-jx3p-rf73](https://github.com/mastodon/mastodon/security/advisories/GHSA-chgx-jx3p-rf73))
+* Updated dependencies
+* Fix type of `interactingObject`, `interactionTarget` and add missing `QuoteAuthorization` ([#38940](https://github.com/tootsuite/mastodon/issues/38940) by [@ClearlyClaire](https://github.com/ClearlyClaire))
+* Remove unused devise strategies ([#38795](https://github.com/tootsuite/mastodon/issues/38795) by [@ClearlyClaire](https://github.com/ClearlyClaire))
+

CloudronManifest.json

@@ -5,8 +5,8 @@
   "description": "file://DESCRIPTION.md",
   "changelog": "file://CHANGELOG",
   "tagline": "Federated social network",
-  "version": "1.17.9",
+  "version": "1.17.11",
-  "upstreamVersion": "4.5.9",
+  "upstreamVersion": "4.5.10",
   "healthCheckPath": "/about",
   "httpPort": 8000,
   "memoryLimit": 1610612736,

Dockerfile

@@ -68,7 +68,7 @@ RUN mkdir -p /app/code /app/pkg
 WORKDIR /app/code
 
 # renovate: datasource=github-releases depName=tootsuite/mastodon versioning=semver extractVersion=^v(?<version>.+)$
-ARG MASTODON_VERSION=4.5.9
+ARG MASTODON_VERSION=4.5.10
 
 ENV RAILS_ENV production
 ENV NODE_ENV production

POSTINSTALL.md

@@ -1,17 +1,17 @@
 Accounts are created with the username and the subdomain under which this app is installed  e.g. `@$CLOUDRON-USERNAME@$CLOUDRON-APP-FQDN`.
 Mastodon does not allow changing the domain part of the account later.
-See [the docs](https://docs.cloudron.io/apps/mastodon/#federation) for more information, f you want to change this domain.
+See [the docs](https://docs.cloudron.io/packages/mastodon/#federation) for more information, f you want to change this domain.
 
 <sso>
 **NOTE:**
-* Mastodon has [restrictions](https://docs.cloudron.io/apps/mastodon/#username-restriction) on usernames that might prevent some users from logging in.
+* Mastodon has [restrictions](https://docs.cloudron.io/packages/mastodon/#username-restriction) on usernames that might prevent some users from logging in.
 
 * External registration [does not work well](https://github.com/mastodon/mastodon/issues/20655) when Cloudron user management is enabled.
 </sso>
 
 <nosso>
 **NOTE:**
-* Open registration is disabled by default. To enable this, see the [docs](https://docs.cloudron.io/apps/mastodon/#registration)
+* Open registration is disabled by default. To enable this, see the [docs](https://docs.cloudron.io/packages/mastodon/#registration)
 
-* To add an initial account follow those [instructions](https://docs.cloudron.io/apps/mastodon/#adding-users)
+* To add an initial account follow those [instructions](https://docs.cloudron.io/packages/mastodon/#adding-users)
 </nosso>

test/test.js

@@ -1,138 +1,47 @@
-#!/usr/bin/env node
 
-import { execSync } from 'node:child_process';
+import { app, clearCache, click, cloudronCli, goto, loginOIDC, sendKeys, setupBrowser, takeScreenshot, teardownBrowser, waitFor } from '@cloudron/charlie';
-import assert from 'node:assert/strict';
-import fs from 'node:fs';
-import path from 'node:path';
-import { Builder, By, until } from 'selenium-webdriver';
-import { Options } from 'selenium-webdriver/chrome';
 
-/* global describe */
+/* global it, describe, before, after, afterEach */
-/* global before */
-/* global after */
-/* global afterEach */
-/* global it */
-/* global xit */
-
-if (!process.env.USERNAME || !process.env.PASSWORD) {
-    console.log('USERNAME and PASSWORD env vars need to be set');
-    process.exit(1);
-}
 
 describe('Application life cycle test', function () {
-    this.timeout(0);
 
-    const LOCATION = process.env.LOCATION || 'test';
+    before(setupBrowser);
-    const TEST_TIMEOUT = parseInt(process.env.TIMEOUT) || 10000;
+    after(teardownBrowser);
-    const EXEC_ARGS = { cwd: path.resolve(import.meta.dirname, '..'), stdio: 'inherit' };
-
-    let browser, app;
-    const username = process.env.USERNAME;
-    const password = process.env.PASSWORD;
-
-    before(function () {
-        const chromeOptions = new Options().windowSize({ width: 1280, height: 1024 });
-        if (process.env.CI) chromeOptions.addArguments('no-sandbox', 'disable-dev-shm-usage', 'headless');
-        browser = new Builder().forBrowser('chrome').setChromeOptions(chromeOptions).build();
-        if (!fs.existsSync('./screenshots')) fs.mkdirSync('./screenshots');
-    });
-
-    after(function () {
-        browser.quit();
-    });
 
     afterEach(async function () {
-        if (!process.env.CI || !app) return;
+        await takeScreenshot(this.currentTest);
-
-        const currentUrl = await browser.getCurrentUrl();
-        if (!currentUrl.includes(app.domain)) return;
-        assert.strictEqual(typeof this.currentTest.title, 'string');
-
-        const screenshotData = await browser.takeScreenshot();
-        fs.writeFileSync(`./screenshots/${new Date().getTime()}-${this.currentTest.title.replaceAll(' ', '_')}.png`, screenshotData, 'base64');
     });
 
-    async function waitForElement(elem) {
+    async function checkRegistrationClosed() {
-        await browser.wait(until.elementLocated(elem), TEST_TIMEOUT);
+        await goto(`https://${app.fqdn}`, 'Create account');
-        await browser.wait(until.elementIsVisible(browser.findElement(elem)), TEST_TIMEOUT);
+        await click('Create account');
+        await waitFor(/is currently not possible/);
     }
 
-    async function exists(selector) {
+    async function login(addr, pass) {
-        await browser.wait(until.elementLocated(selector), TEST_TIMEOUT);
+        await goto(`https://${app.fqdn}/auth/sign_in`, 'Log in');
+        await sendKeys('label=E-mail address', addr);
+        await sendKeys('label=Password', pass);
+        await click('Log in');
     }
 
-    async function visible(selector) {
+    async function loginOidc() {
-        await exists(selector);
+        await goto(`https://${app.fqdn}/auth/sign_in`, 'Cloudron');
-        await browser.wait(until.elementIsVisible(browser.findElement(selector)), TEST_TIMEOUT);
+        await click('Cloudron');
-    }
+        await loginOIDC(/Bookmarks|Successfully authenticated from Cloudron account\./);
-
-    async function checkRegistration(mode) {
-        if (mode === 'none') {
-            await browser.get('https://' + app.fqdn);
-            await browser.sleep(2000);
-            await browser.findElement(By.xpath('//div[@class="sign-in-banner"]/descendant::button/span[contains(text(), "Create account")] | //div[@class="sign-in-banner"]/descendant::a/span[contains(text(), "Create account")]')).click();
-            await visible(By.xpath('//span[contains(text()[2], "is currently not possible")]'));
-        } else if (mode === 'open') {
-            await browser.get('https://' + app.fqdn + '/auth/sign_up');
-            await visible(By.xpath('//button[contains(text(), "Sign up")]'));
-        }
-    }
-
-    async function login(username, password) {
-        await browser.get('https://' + app.fqdn + '/auth/sign_in'); // there is also separate login page at /users/sign_in
-        await visible(By.xpath('//button[contains(text(), "Log in")]'));
-        await browser.findElement(By.id('user_email')).sendKeys(username);
-        await browser.findElement(By.id('user_password')).sendKeys(password);
-        await browser.findElement(By.xpath('//button[contains(text(), "Log in")]')).click();
-        await browser.sleep(3000); // can be wizard or timeline at this point
-    }
-
-    async function loginOIDC(username, password, hasSession) {
-        browser.manage().deleteAllCookies();
-        await browser.get(`https://${app.fqdn}/auth/sign_in`);
-        await browser.sleep(4000);
-
-        await browser.findElement(By.xpath('//a[contains(@class, "button") and text()="Cloudron"]')).click();
-        await browser.sleep(4000);
-
-        if (!hasSession) {
-            await waitForElement(By.id('inputUsername'));
-            await browser.findElement(By.id('inputUsername')).sendKeys(username);
-            await browser.findElement(By.id('inputPassword')).sendKeys(password);
-            await browser.findElement(By.id('loginSubmitButton')).click();
-        }
-
-        await waitForElement(By.xpath('//span[contains(., "Bookmarks")] | //strong[text()="Successfully authenticated from Cloudron account."]'));
-    }
-
-    async function logout() {
-        await browser.get('https://' + app.fqdn + '/settings/preferences/appearance'); // there is also separate login page at /users/sign_in
-        await browser.wait(until.elementLocated(By.id('logout')), TEST_TIMEOUT);
-        await browser.findElement(By.id('logout')).click();
-        await visible(By.id('user_email'));
     }
 
     async function checkTimeline() {
-        await browser.get('https://' + app.fqdn + '/home');
+        await goto(`https://${app.fqdn}/home`, /Your home timeline is empty/);
-        await visible(By.xpath('//span[contains(text(), "Your home timeline is empty")]'));
     }
 
-    function getAppInfo() {
-        const inspect = JSON.parse(execSync('cloudron inspect'));
-        app = inspect.apps.filter(function (a) { return a.location === LOCATION || a.location === LOCATION + '2'; })[0];
-        assert.ok(app && typeof app === 'object');
-    }
-
-    xit('build app', function () { execSync('cloudron build', EXEC_ARGS); });
-
     // No SSO
-    it('install app (no sso)', function () { execSync('cloudron install --no-sso --location ' + LOCATION, EXEC_ARGS); });
+    it('install app (no sso)', function () { cloudronCli.install({ noSso: true }); });
-    it('can get app information', getAppInfo);
 
-    it('has registration open', checkRegistration.bind(null, 'none'));
+    it('has registration closed', checkRegistrationClosed);
     let testPassword;
     it('create a user with CLI', function () {
-        const output = execSync('cloudron exec --app ' + LOCATION + ' -- bin/tootctl accounts create test --email=test@cloudron.io', { cwd: path.resolve(import.meta.dirname, '..'), encoding: 'utf8' });
+        const output = cloudronCli.exec('bin/tootctl accounts create test --email=test@cloudron.io').toString();
         console.log(output);
         testPassword = output.slice(output.indexOf('New password: ') + 'New password: '.length).trim();
         console.log(testPassword);
@@ -143,64 +52,43 @@ describe('Application life cycle test', function () {
     });
 
     it('shows confirmation page', async function () {
-        await waitForElement(By.xpath('//a[@href="/auth/confirmation/new"] | //form[@id="edit_user_1"]'));
+        await waitFor('Check your inbox');
     });
 
-    it('uninstall app (no sso)', async function () {
+    it('uninstall app (no sso)', cloudronCli.uninstall);
-        await browser.get('about:blank');
-        execSync('cloudron uninstall --app ' + app.id, EXEC_ARGS);
-    });
 
     // SSO
-    it('install app (sso)', function () { execSync('cloudron install --location ' + LOCATION, EXEC_ARGS); });
+    it('install app (sso)', cloudronCli.install);
 
-    it('can get app information', getAppInfo);
+    it('registration is disabled', checkRegistrationClosed);
-    it('registration is disabled', checkRegistration.bind(null, 'none'));
+    it('can OIDC login', loginOidc);
-    it('can OIDC login', loginOIDC.bind(null, username, password, false));
     it('can see timeline', checkTimeline);
-    it('can logout', logout);
+    it('can logout', clearCache);
 
-    it('backup app', function () { execSync('cloudron backup create --app ' + app.id, EXEC_ARGS); });
+    it('backup app', cloudronCli.createBackup);
-    it('restore app', function () {
+    it('restore app', cloudronCli.restoreFromLatestBackup);
-        const backups = JSON.parse(execSync('cloudron backup list --raw'));
-        execSync('cloudron uninstall --app ' + app.id, EXEC_ARGS);
-        execSync('cloudron install --location ' + LOCATION, EXEC_ARGS);
-        getAppInfo();
-        execSync(`cloudron restore --backup ${backups[0].id} --app ${app.id}`, EXEC_ARGS);
-    });
 
-    it('can OIDC login', loginOIDC.bind(null, username, password, true));
+    it('can OIDC login', loginOidc);
     it('can see timeline', checkTimeline);
 
-    it('can restart app', function () { execSync('cloudron restart --app ' + app.id, EXEC_ARGS); });
+    it('can restart app', cloudronCli.restart);
     it('can see timeline', checkTimeline);
 
-    it('move to different location', async function () {
+    it('move to different location', cloudronCli.changeLocation);
-        await browser.get('about:blank');
-        execSync('cloudron configure --location ' + LOCATION + '2 --app ' + app.id, EXEC_ARGS);
-    });
-    it('can get app information', getAppInfo);
 
-    it('can OIDC login', loginOIDC.bind(null, username, password, true));
+    it('can OIDC login', loginOidc);
     it('can see timeline', checkTimeline);
 
-    it('uninstall app', async function () {
+    it('uninstall app', cloudronCli.uninstall);
-        await browser.get('about:blank');
-        execSync('cloudron uninstall --app ' + app.id, EXEC_ARGS);
-    });
 
     // test update
-    it('can install app', function () { execSync('cloudron install --appstore-id org.joinmastodon.cloudronapp --location ' + LOCATION, EXEC_ARGS); });
+    it('can install app for update', cloudronCli.appstoreInstall);
-    it('can get app information', getAppInfo);
+    it('can OIDC login', loginOidc);
-    it('can OIDC login', loginOIDC.bind(null, username, password, true));
+    it('can logout', clearCache);
-    it('can logout', logout);
 
-    it('can update', async function () {
+    it('can update', cloudronCli.update);
-        await browser.get('about:blank');
+
-        execSync('cloudron update --app ' + LOCATION, EXEC_ARGS);
+    it('can OIDC login', loginOidc);
-    });
+
-
+    it('uninstall app', cloudronCli.uninstall);
-    it('can OIDC login', loginOIDC.bind(null, username, password, true));
-
-    it('uninstall app', function () { execSync('cloudron uninstall --app ' + app.id, EXEC_ARGS); });
 });