test(server): add validation test of api:notes/create (#10090)

* fix(server): notes/createのバリデーションが効いていない
Fix #10079

Co-Authored-By: mei23 <m@m544.net>

* anyOf内にバリデーションを書いても最初の一つしかチェックされない

* :v:

* wip

* wip

* :v:

* RequiredProp

* Revert "RequiredProp"

This reverts commit 74693900119a590263106fa3adefd008d69ce80c.

* add api:notes/create

* fix lint

* text

* :v:

* improve readability

---------

Co-authored-by: mei23 <m@m544.net>
Co-authored-by: syuilo <Syuilotan@yahoo.co.jp>

3 files changed, 304 insertions, 82 deletions

diff --git a/packages/backend/src/server/api/endpoints/notes/create.test.ts b/packages/backend/src/server/api/endpoints/notes/create.test.ts
new file mode 100644
index 0000000000..4e5ec361f9
--- /dev/null
+++ b/packages/backend/src/server/api/endpoints/notes/create.test.ts
@@ -0,0 +1,248 @@
+process.env.NODE_ENV = 'test';
+
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { dirname } from 'node:path';
+import { describe, test, expect } from '@jest/globals';
+import { getValidator } from '../../../../../test/prelude/get-api-validator.js';
+import { paramDef } from './create.js';
+
+const _filename = fileURLToPath(import.meta.url);
+const _dirname = dirname(_filename);
+
+const VALID = true;
+const INVALID = false;
+
+describe('api:notes/create', () => {
+	describe('validation', () => {
+		const v = getValidator(paramDef);
+		const tooLong = readFile(_dirname + '/../../../../../test/resources/misskey.svg', 'utf-8');
+
+		test('reject empty', () => {
+			const valid = v({ });
+			expect(valid).toBe(INVALID);
+		});
+
+		describe('text', () => {
+			test('simple post', () => {
+				expect(v({ text: 'Hello, world!' }))
+					.toBe(VALID);
+			});
+
+			test('null post', () => {
+				expect(v({ text: null }))
+					.toBe(INVALID);
+			});
+
+			test('0 characters post', () => {
+				expect(v({ text: '' }))
+					.toBe(INVALID);
+			});
+
+			test('over 3000 characters post', async () => {
+				expect(v({ text: await tooLong }))
+					.toBe(INVALID);
+			});
+		});
+
+		describe('cw', () => {
+			test('simple cw', () => {
+				expect(v({ text: 'Hello, world!', cw: 'Hello, world!' }))
+					.toBe(VALID);
+			});
+
+			test('null cw', () => {
+				expect(v({ text: 'Body', cw: null }))
+					.toBe(VALID);
+			});
+
+			test('0 characters cw', () => {
+				expect(v({ text: 'Body', cw: '' }))
+					.toBe(VALID);
+			});
+
+			test('reject only cw', () => {
+				expect(v({ cw: 'Hello, world!' }))
+					.toBe(INVALID);
+			});
+
+			test('over 100 characters cw', async () => {
+				expect(v({ text: 'Body', cw: await tooLong }))
+					.toBe(INVALID);
+			});
+		});
+
+		describe('visibility', () => {
+			test('public', () => {
+				expect(v({ text: 'Hello, world!', visibility: 'public' }))
+					.toBe(VALID);
+			});
+
+			test('home', () => {
+				expect(v({ text: 'Hello, world!', visibility: 'home' }))
+					.toBe(VALID);
+			});
+
+			test('followers', () => {
+				expect(v({ text: 'Hello, world!', visibility: 'followers' }))
+					.toBe(VALID);
+			});
+
+			test('reject only visibility', () => {
+				expect(v({ visibility: 'public' }))
+					.toBe(INVALID);
+			});
+
+			test('reject invalid visibility', () => {
+				expect(v({ text: 'Hello, world!', visibility: 'invalid' }))
+					.toBe(INVALID);
+			});
+
+			test('reject null visibility', () => {
+				expect(v({ text: 'Hello, world!', visibility: null }))
+					.toBe(INVALID);
+			});
+
+			describe('visibility:specified', () => {
+				test('specified without visibleUserIds', () => {
+					expect(v({ text: 'Hello, world!', visibility: 'specified' }))
+						.toBe(VALID);
+				});
+
+				test('specified with empty visibleUserIds', () => {
+					expect(v({ text: 'Hello, world!', visibility: 'specified', visibleUserIds: [] }))
+						.toBe(VALID);
+				});
+
+				test('reject specified with non unique visibleUserIds', () => {
+					expect(v({ text: 'Hello, world!', visibility: 'specified', visibleUserIds: ['1', '1', '2'] }))
+						.toBe(INVALID);
+				});
+
+				test('reject specified with null visibleUserIds', () => {
+					expect(v({ text: 'Hello, world!', visibility: 'specified', visibleUserIds: null }))
+						.toBe(INVALID);
+				});
+			});
+		});
+
+		describe('fileIds', () => {
+			test('only fileIds', () => {
+				expect(v({ fileIds: ['1', '2', '3'] }))
+					.toBe(VALID);
+			});
+
+			test('text and fileIds', () => {
+				expect(v({ text: 'Hello, world!', fileIds: ['1', '2', '3'] }))
+					.toBe(VALID);
+			});
+
+			test('reject null fileIds', () => {
+				expect(v({ fileIds: null }))
+					.toBe(INVALID);
+			});
+
+			test('reject text and null fileIds （複合的なanyOfのバリデーションが正しく動作する）', () => {
+				expect(v({ text: 'Hello, world!', fileIds: null }))
+					.toBe(INVALID);
+			});
+
+			test('reject 0 files', () => {
+				expect(v({ fileIds: [] }))
+					.toBe(INVALID);
+			});
+
+			test('reject non unique', () => {
+				expect(v({ fileIds: ['1', '1', '2'] }))
+					.toBe(INVALID);
+			});
+
+			test('reject invalid id', () => {
+				expect(v({ fileIds: ['あ'] }))
+					.toBe(INVALID);
+			});
+
+			test('reject over 17 files', () => {
+				const valid = v({ text: 'Hello, world!', fileIds: ['1', '2', '3', '4', '5', '6', '7', '8', '9', '10', '11', '12', '13', '14', '15', '16', '17', '18'] });
+				expect(valid).toBe(INVALID);
+			});
+		});
+
+		describe('poll', () => {
+			test('note with poll', () => {
+				expect(v({ text: 'Hello, world!', poll: { choices: ['a', 'b', 'c'] } }))
+					.toBe(VALID);
+			});
+
+			test('null poll', () => {
+				expect(v({ text: 'Hello, world!', poll: null }))
+					.toBe(VALID);
+			});
+
+			test('allow only poll', () => {
+				expect(v({ poll: { choices: ['a', 'b', 'c'] } }))
+					.toBe(VALID);
+			});
+
+			test('poll with expiresAt', async () => {
+				expect(v({ poll: { choices: ['a', 'b', 'c'], expiresAt: 1 } }))
+					.toBe(VALID);
+			});
+
+			test('poll with expiredAfter', async () => {
+				expect(v({ poll: { choices: ['a', 'b', 'c'], expiredAfter: 1 } }))
+					.toBe(VALID);
+			});
+
+			test('reject poll without choices', () => {
+				expect(v({ poll: { } }))
+					.toBe(INVALID);
+			});
+
+			test('reject poll with empty choices', () => {
+				expect(v({ poll: { choices: [] } }))
+					.toBe(INVALID);
+			});
+
+			test('reject poll with null choices', () => {
+				expect(v({ poll: { choices: null } }))
+					.toBe(INVALID);
+			});
+
+			test('reject poll with 1 choice', () => {
+				expect(v({ poll: { choices: ['a'] } }))
+					.toBe(INVALID);
+			});
+
+			test('reject poll with too long choice', async () => {
+				expect(v({ poll: { choices: [await tooLong, '2'] } }))
+					.toBe(INVALID);
+			});
+
+			test('reject poll with too many choices', () => {
+				expect(v({ poll: { choices: ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k'] } }))
+					.toBe(INVALID);
+			});
+
+			test('reject poll with non unique choices', () => {
+				expect(v({ poll: { choices: ['a', 'a', 'b', 'c'] } }))
+					.toBe(INVALID);
+			});
+
+			test('reject poll with expiredAfter 0', async () => {
+				expect(v({ poll: { choices: ['a', 'b', 'c'], expiredAfter: 0 } }))
+					.toBe(INVALID);
+			});
+		});
+
+		test('text, fileIds and poll', () => {
+			expect(v({ text: 'Hello, world!', fileIds: ['1', '2', '3'], poll: { choices: ['a', 'b', 'c'] } }))
+				.toBe(VALID);
+		});
+
+		test('text, invalid fileIds and invalid poll', () => {
+			expect(v({ text: 'Hello, world!', fileIds: ['あ'], poll: { choices: ['a'] } }))
+				.toBe(INVALID);
+		});
+	});
+});
diff --git a/packages/backend/src/server/api/endpoints/notes/create.ts b/packages/backend/src/server/api/endpoints/notes/create.ts
index f4c5a84a4f..2848cd7df1 100644
--- a/packages/backend/src/server/api/endpoints/notes/create.ts
+++ b/packages/backend/src/server/api/endpoints/notes/create.ts
@@ -101,74 +101,55 @@ export const paramDef = {
 		noExtractHashtags: { type: 'boolean', default: false },
 		noExtractEmojis: { type: 'boolean', default: false },
 		replyId: { type: 'string', format: 'misskey:id', nullable: true },
+		renoteId: { type: 'string', format: 'misskey:id', nullable: true },
 		channelId: { type: 'string', format: 'misskey:id', nullable: true },
-	},
-	anyOf: [
-		{
-			// (re)note with text, files and poll are optional
-			properties: {
-				text: { type: 'string', minLength: 1, maxLength: MAX_NOTE_TEXT_LENGTH, nullable: false },
-			},
-			required: ['text'],
+
+		// anyOf内にバリデーションを書いても最初の一つしかチェックされない
+		// See https://github.com/misskey-dev/misskey/pull/10082
+		text: {
+			type: 'string',
+			minLength: 1,
+			maxLength: MAX_NOTE_TEXT_LENGTH,
+			nullable: false
 		},
-		{
-			// (re)note with files, text and poll are optional
-			properties: {
-				fileIds: {
-					type: 'array',
-					uniqueItems: true,
-					minItems: 1,
-					maxItems: 16,
-					items: { type: 'string', format: 'misskey:id' },
-				},
-			},
-			required: ['fileIds'],
+		fileIds: {
+			type: 'array',
+			uniqueItems: true,
+			minItems: 1,
+			maxItems: 16,
+			items: { type: 'string', format: 'misskey:id' },
 		},
-		{
-			// (re)note with files, text and poll are optional
+		mediaIds: {
+			type: 'array',
+			uniqueItems: true,
+			minItems: 1,
+			maxItems: 16,
+			items: { type: 'string', format: 'misskey:id' },
+		},
+		poll: {
+			type: 'object',
+			nullable: true,
 			properties: {
-				mediaIds: {
-					deprecated: true,
-					description: 'Use `fileIds` instead. If both are specified, this property is discarded.',
+				choices: {
 					type: 'array',
 					uniqueItems: true,
-					minItems: 1,
-					maxItems: 16,
-					items: { type: 'string', format: 'misskey:id' },
-				},
-			},
-			required: ['mediaIds'],
-		},
-		{
-			// (re)note with poll, text and files are optional
-			properties: {
-				poll: {
-					type: 'object',
-					nullable: true,
-					properties: {
-						choices: {
-							type: 'array',
-							uniqueItems: true,
-							minItems: 2,
-							maxItems: 10,
-							items: { type: 'string', minLength: 1, maxLength: 50 },
-						},
-						multiple: { type: 'boolean' },
-						expiresAt: { type: 'integer', nullable: true },
-						expiredAfter: { type: 'integer', nullable: true, minimum: 1 },
-					},
-					required: ['choices'],
+					minItems: 2,
+					maxItems: 10,
+					items: { type: 'string', minLength: 1, maxLength: 50 },
 				},
+				multiple: { type: 'boolean' },
+				expiresAt: { type: 'integer', nullable: true },
+				expiredAfter: { type: 'integer', nullable: true, minimum: 1 },
 			},
-			required: ['poll'],
-		},
-		{
-			// pure renote
-			properties: {
-				renoteId: { type: 'string', format: 'misskey:id', nullable: true },
-			},
-			required: ['renoteId'],
+			required: ['choices'],
 		},
+	},
+	// (re)note with text, files and poll are optional
+	anyOf: [
+		{ required: ['text'] },
+		{ required: ['fileIds'] },
+		{ required: ['mediaIds'] },
+		{ required: ['poll'] },
 	],
 } as const;
 
diff --git a/packages/backend/src/server/api/endpoints/notes/search-by-tag.ts b/packages/backend/src/server/api/endpoints/notes/search-by-tag.ts
index bcd793ac43..da1a4bcc46 100644
--- a/packages/backend/src/server/api/endpoints/notes/search-by-tag.ts
+++ b/packages/backend/src/server/api/endpoints/notes/search-by-tag.ts
@@ -36,32 +36,25 @@ export const paramDef = {
 		sinceId: { type: 'string', format: 'misskey:id' },
 		untilId: { type: 'string', format: 'misskey:id' },
 		limit: { type: 'integer', minimum: 1, maximum: 100, default: 10 },
-	},
-	anyOf: [
-		{
-			properties: {
-				tag: { type: 'string', minLength: 1 },
-			},
-			required: ['tag'],
-		},
-		{
-			properties: {
-				query: {
-					type: 'array',
-					description: 'The outer arrays are chained with OR, the inner arrays are chained with AND.',
-					items: {
-						type: 'array',
-						items: {
-							type: 'string',
-							minLength: 1,
-						},
-						minItems: 1,
-					},
-					minItems: 1,
+
+		tag: { type: 'string', minLength: 1 },
+		query: {
+			type: 'array',
+			description: 'The outer arrays are chained with OR, the inner arrays are chained with AND.',
+			items: {
+				type: 'array',
+				items: {
+					type: 'string',
+					minLength: 1,
 				},
+				minItems: 1,
 			},
-			required: ['query'],
+			minItems: 1,
 		},
+	},
+	anyOf: [
+		{ required: ['tag'] },
+		{ required: ['query'] },
 	],
 } as const;