1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
# frozen_string_literal: true

require_relative "test_helper"

require "minitest/autorun"
require "rack/test"
require "logger"
require "stringio"

require_relative "../lib/rank_king/web"

class TestYouTube < Minitest::Test
  include Rack::Test::Methods

  # The app, with the fake InnerTube in its config.
  class App < RankKing::Web
    singleton_class.attr_accessor :inner_tube

    private def config = RankKing::CONFIG.with(inner_tube: self.class.inner_tube)
  end

  def app = App.app

  LOGIN = "alpha@example.com"
  PLAYLIST = "PLabc123"
  COOKIE = "SID=sid; SAPISID=sapisid; __Secure-3PAPISID=3papisid"

  # InnerTube, as far as rank-king talks to it: the real client with its
  # requests answered here, in the shapes youtube.com gets. A playlist
  # pages two videos at a time, so fetching it has to follow its
  # continuations.
  class FakeInnerTube < RankKing::InnerTube
    attr_reader :calls
    attr_accessor :videos, :user_playlists, :error, :signed_out

    def initialize
      super
      @calls = []
      @videos = []
      @user_playlists = [["WL", "Watch later"], ["PLabc123", "Music"]]
    end

    private

    def request(cookie, body)
      @calls << [cookie, body]
      raise RankKing::InnerTube::Error, error if error
      return signed_out_page if signed_out
      return playlists_page if body[:browseId] == "FEplaylist_aggregation"

      page = body[:continuation].to_i
      items = videos[page * 2, 2].to_a.map { |id, title| video(id, title) }
      items << continuation(page + 1, first: page.zero?) if videos.size > (page + 1) * 2
      return signed_in("onResponseReceivedActions" => [{ "appendContinuationItemsAction" => { "continuationItems" => items } }]) if page.positive?

      list = { "playlistVideoListRenderer" => { "contents" => items } }
      signed_in("contents" => { "twoColumnBrowseResultsRenderer" => { "tabs" => [
        { "tabRenderer" => { "content" => { "sectionListRenderer" => { "contents" => [
          { "itemSectionRenderer" => { "contents" => [list] } },
        ] } } } },
      ] } })
    end

    def signed_in(body) = { "responseContext" => tracking("1"), **body }

    def tracking(logged_in) = { "serviceTrackingParams" => [{ "params" => [{ "key" => "logged_in", "value" => logged_in }] }] }

    def signed_out_page
      { "responseContext" => tracking("0"),
        "alerts" => [{ "alertRenderer" => { "type" => "ERROR", "text" => { "runs" => [{ "text" => "The playlist does not exist." }] } } }] }
    end

    def playlists_page
      lockups = user_playlists.map { |id, title|
        { "lockupViewModel" => { "contentId" => id, "contentType" => "LOCKUP_CONTENT_TYPE_PLAYLIST",
                                 "metadata" => { "lockupMetadataViewModel" => { "title" => { "content" => title } } } } }
      }
      signed_in("contents" => { "richGridRenderer" => { "contents" => lockups.map { { "richItemRenderer" => { "content" => _1 } } } } })
    end

    # A nil title stands for a deleted video, which is not playable.
    def video(id, title)
      { "playlistVideoRenderer" => {
        "videoId" => id, "isPlayable" => !title.nil?,
        "title" => { "runs" => [{ "text" => title || "[Deleted video]" }] },
        "shortBylineText" => { "runs" => [{ "text" => "A channel" }] },
      } }
    end

    # The first page wraps its continuation in a command executor; later
    # ones carry it bare.
    def continuation(token, first:)
      command = { "continuationCommand" => { "token" => token.to_s } }
      endpoint = first ? { "commandExecutorCommand" => { "commands" => [{}, command] } } : command
      { "continuationItemRenderer" => { "continuationEndpoint" => endpoint } }
    end
  end

  def setup
    header "Remote-User", LOGIN
    RankKing::DB[:results].delete
    RankKing::DB[:axes].delete
    RankKing::DB[:items].delete
    RankKing::DB[:lists].delete
    RankKing::DB[:users].delete

    @inner_tube = FakeInnerTube.new
    App.inner_tube = @inner_tube
  end

  def test_new_list_asks_for_a_cookie_before_the_playlists
    get "/lists/new"
    assert_includes last_response.body, %(<option value="YouTube">YouTube playlist</option>)
    assert_includes last_response.body, %(<textarea name="cookie")
    assert_includes last_response.body, %(data-playlists="/youtube/playlists")
    refute_includes last_response.body, %(name="playlist")
    assert_empty @inner_tube.calls
  end

  def test_a_pasted_cookie_lists_the_playlists
    playlists("Cookie: #{COOKIE}\n")
    assert last_response.ok?
    assert_includes last_response.body, %(<select name="playlist" required>)
    assert_includes last_response.body, %(<option value="WL">Watch later</option>)
    assert_includes last_response.body, %(<option value="PLabc123">Music</option>)
    refute_includes last_response.body, "<html"
    assert_equal [COOKIE, { browseId: "FEplaylist_aggregation" }], @inner_tube.calls.last
  end

  def test_listing_playlists_needs_the_form_token
    post "/youtube/playlists", { cookie: COOKIE }
    assert_equal 403, last_response.status
    assert_empty @inner_tube.calls
  end

  def test_a_cookie_with_nothing_to_sign_with_lists_nothing
    playlists("SID=sid; HSID=hsid")
    assert_includes last_response.body, "no SAPISID"
    assert_empty @inner_tube.calls
  end

  def test_says_when_there_are_no_playlists
    @inner_tube.user_playlists = []
    playlists(COOKIE)
    assert_includes last_response.body, "no playlists yet"
  end

  def test_says_when_youtube_signed_the_cookie_out
    @inner_tube.signed_out = true
    playlists(COOKIE)
    assert last_response.ok?
    assert_includes last_response.body, "YouTube signed the cookie out."
  end

  def test_authorization_signs_each_api_cookie
    at = 1_700_000_000
    sign = ->(value) { Digest::SHA1.hexdigest("#{at} #{value} https://www.youtube.com") }

    assert_equal "SAPISIDHASH #{at}_#{sign.("sapisid")} SAPISID3PHASH #{at}_#{sign.("3papisid")}",
      RankKing::InnerTube.authorization(COOKIE, at:)
  end

  def test_create_a_list_from_a_playlist
    @inner_tube.videos = [["v1", "First"], ["v2", nil], ["v3", "Third"], ["v4", "Fourth"], ["v1", "First again"]]

    create_list(playlist: PLAYLIST)
    assert last_response.redirect?

    list = RankKing::List.first
    assert_equal "YouTube", list.source_kind
    refute_nil list.synced_at
    assert_equal %w[First Third Fourth], names(list)
    assert_equal PLAYLIST, RankKing::DB[:youtube_sources].where(list_id: list.id).get(:playlist_id)
    assert_equal %w[v1 v3 v4], RankKing::DB[:youtube_items].order(:item_id).map(:video_id)
    first = RankKing::DB[:youtube_items].first(video_id: "v1")
    assert_equal "First", first[:title]
    assert_equal "A channel", first[:channel_title]
    assert_equal "https://i.ytimg.com/vi/v1/mqdefault.jpg", first[:thumbnail_url]

    assert_equal [{ browseId: "VLPLabc123" }, { continuation: "1" }, { continuation: "2" }], @inner_tube.calls.map(&:last)
    assert_equal [COOKIE], @inner_tube.calls.map(&:first).uniq
  end

  def test_create_a_list_from_watch_later
    @inner_tube.videos = [["v1", "First"], ["v2", "Second"]]
    create_list(playlist: "WL")

    assert_equal %w[First Second], names(RankKing::List.first)
    assert_equal({ browseId: "VLWL" }, @inner_tube.calls.last.last)
  end

  def test_create_needs_a_cookie
    create_list(playlist: PLAYLIST, cookie: "SID=sid")
    assert_equal 422, last_response.status
    assert_equal "That cookie has no SAPISID to sign requests with.\n", last_response.body
    assert_equal 0, RankKing::List.count
    assert_empty @inner_tube.calls
  end

  def test_create_needs_a_playlist
    create_list(playlist: "not a playlist")
    assert_equal 422, last_response.status
    assert_equal "Choose a playlist to follow.\n", last_response.body
    assert_equal 0, RankKing::List.count
  end

  def test_sync_adds_archives_and_restores_by_video
    @inner_tube.videos = [["v1", "First"], ["v2", "Second"]]
    create_list(playlist: PLAYLIST)
    list = RankKing::List.first
    first, second = list.items_dataset.order(:id).all

    @inner_tube.videos = [["v1", "First, renamed"], ["v3", "Third"]]
    sync(list, cookie: "SAPISID=fresh")
    assert last_response.redirect?
    assert_equal ["First, renamed", "Third"], names(list)
    refute_nil second.reload.archived_at
    assert_equal "First, renamed", first.reload.name
    assert_equal "First, renamed", RankKing::DB[:youtube_items].first(item_id: first.id)[:title]
    assert_equal "SAPISID=fresh", @inner_tube.calls.last.first

    @inner_tube.videos = [["v2", "Second"]]
    sync(list)
    assert_equal %w[Second], names(list)
    assert_nil second.reload.archived_at
  end

  def test_list_shows_each_video_from_one_read
    @inner_tube.videos = [["v1", "First"], ["v2", "Second"], ["v3", "Third"]]
    create_list(playlist: PLAYLIST)
    list = RankKing::List.first

    reads = youtube_item_reads { get "/lists/#{list.id}" }
    assert_includes last_response.body, %(<img src="https://i.ytimg.com/vi/v1/mqdefault.jpg" alt="" loading="lazy">)
    assert_includes last_response.body, "<span>Third</span><small>A channel</small>"
    assert_equal 1, reads
  end

  def test_compare_shows_each_video
    @inner_tube.videos = [["v1", "First"], ["v2", "Second"]]
    create_list(playlist: PLAYLIST)
    list = RankKing::List.first
    axis = RankKing::Axis.create(list_id: list.id, name: "Watch first")

    get "/lists/#{list.id}/axes/#{axis.id}/compare"
    buttons = last_response.body.scan(%r{<button type="submit">(.*?)</button>})
    assert_equal 2, buttons.size
    %w[v1 v2].each do |id|
      assert(buttons.any? { |(html)| html.include?("vi/#{id}/mqdefault.jpg") && html.include?("<small>A channel</small>") })
    end
  end

  def test_a_video_without_a_thumbnail_or_channel_shows_its_title
    @inner_tube.videos = [["v1", "First"], ["v2", "Second"]]
    create_list(playlist: PLAYLIST)
    list = RankKing::List.first
    RankKing::DB[:youtube_items].update(channel_title: nil, thumbnail_url: nil)

    get "/lists/#{list.id}"
    assert_includes last_response.body, %(<span data-video><span><span>First</span></span></span>)
    refute_includes last_response.body, "<img"
  end

  def test_sync_dialog_asks_for_a_cookie_and_shows_progress
    @inner_tube.videos = [["v1", "First"], ["v2", "Second"]]
    create_list(playlist: PLAYLIST)

    get "/lists/#{RankKing::List.first.id}"
    assert_includes last_response.body, "Sync from YouTube"
    assert_includes last_response.body, %(<textarea name="cookie")
    assert_includes last_response.body, %(data-busy="Syncing…")
  end

  def test_sync_needs_a_cookie
    @inner_tube.videos = [["v1", "First"], ["v2", "Second"]]
    create_list(playlist: PLAYLIST)
    list = RankKing::List.first
    @inner_tube.calls.clear

    sync(list, cookie: "")
    assert_equal 502, last_response.status
    assert_includes last_response.body, "no SAPISID"
    assert_empty @inner_tube.calls
  end

  def test_a_signed_out_cookie_archives_nothing
    @inner_tube.videos = [["v1", "First"], ["v2", "Second"]]
    create_list(playlist: PLAYLIST)
    list = RankKing::List.first

    @inner_tube.signed_out = true
    sync(list)
    assert_equal 502, last_response.status
    assert_includes last_response.body, "YouTube: YouTube signed the cookie out."
    assert_equal %w[First Second], names(list)
  end

  def test_youtube_errors_are_reported
    @inner_tube.videos = [["v1", "First"], ["v2", "Second"]]
    create_list(playlist: PLAYLIST)
    list = RankKing::List.first

    @inner_tube.error = "Request contains an invalid argument."
    sync(list)
    assert_equal 502, last_response.status
    assert_includes last_response.body, "Request contains an invalid argument."
    assert_equal %w[First Second], names(list)
  end

  def test_deleting_a_youtube_list
    @inner_tube.videos = [["v1", "First"], ["v2", "Second"]]
    create_list(playlist: PLAYLIST)
    list = RankKing::List.first

    csrf_post "/lists/#{list.id}/delete", {}, from: "/lists/#{list.id}/settings"
    assert last_response.redirect?
    assert_equal 0, RankKing::DB[:youtube_sources].count
    assert_equal 0, RankKing::DB[:youtube_items].count
  end

  private

  def names(list) = list.items_dataset.order(:id).map(:name)

  # How many times the block reads youtube_items.
  def youtube_item_reads
    log = StringIO.new
    logger = Logger.new(log)
    RankKing::DB.loggers << logger
    yield
    log.string.scan(/SELECT .* FROM `youtube_items`/).size
  ensure
    RankKing::DB.loggers.delete(logger)
  end

  # Posts the cookie as app.js does, with the token the new-list form
  # carries for it.
  def playlists(cookie)
    get "/lists/new"
    token = last_response.body[/data-playlists="\/youtube\/playlists" data-csrf="([^"]+)"/, 1]
    post "/youtube/playlists", { cookie:, "_csrf" => token }
  end

  def create_list(playlist:, cookie: COOKIE)
    csrf_post "/lists", { name: "Videos", source: "YouTube", playlist:, cookie: }, from: "/lists/new"
  end

  def sync(list, cookie: COOKIE)
    csrf_post "/lists/#{list.id}/sync", { cookie: }, from: "/lists/#{list.id}"
  end

  def csrf_post(path, params, from:)
    get from
    token = last_response.body[/action="#{Regexp.escape(path)}".*?name="_csrf" value="([^"]+)"/m, 1]
    post path, params.merge("_csrf" => token)
  end
end