test(privacy): cover everyone private-message policy

docs/core-checklist-status.md

@@ -37,7 +37,7 @@ Legend:
 28. Notifications - `PARTIAL` (browser notifications + mute/settings; no mobile push infra)
 29. Archive - `DONE`
 30. Blacklist - `DONE`
-31. Privacy - `PARTIAL` (avatar/last-seen/group-invites + PM policy `everyone|contacts|nobody`; integration tests cover PM policy `contacts/nobody`, group-invite policy `contacts/nobody`, and private chat counterpart visibility for `nobody/contacts`, remaining UX/matrix hardening)
+31. Privacy - `PARTIAL` (avatar/last-seen/group-invites + PM policy `everyone|contacts|nobody`; integration tests cover PM policy matrix (`everyone/contacts/nobody`), group-invite policy `contacts/nobody`, and private chat counterpart visibility for `nobody/contacts`, remaining UX/matrix hardening)
 32. Security - `PARTIAL` (sessions + revoke + 2FA base + access-session visibility; integration tests cover single-session revoke and revoke-all invalidation/force-disconnect; 2FA setup now blocked after enable to prevent secret re-issuance; one-time recovery codes added; UX polish ongoing)
 33. Realtime Events - `DONE` (connect/disconnect/send/receive/typing/read/delivered/online/offline + chat/message updates + chat_deleted)
 34. Sync - `PARTIAL` (cross-device via backend state + realtime; reconciliation improved for loaded chats/messages, chat-info panel hot-refreshes on `chat_updated`, delete/leave updates realtime subscriptions, full-chat delete emits `chat_deleted`)

tests/test_chat_message_flow.py

@@ -135,6 +135,28 @@ async def test_private_chat_respects_nobody_policy(client, db_session):
     assert create_chat_still_blocked.status_code == 403
 
 
+async def test_private_chat_respects_everyone_policy_without_contacts(client, db_session):
+    u1 = await _create_verified_user(client, db_session, "pm_everyone_u1@example.com", "pm_everyone_u1", "strongpass123")
+    u2 = await _create_verified_user(client, db_session, "pm_everyone_u2@example.com", "pm_everyone_u2", "strongpass123")
+
+    me_u2 = await client.get("/api/v1/auth/me", headers={"Authorization": f"Bearer {u2['access_token']}"})
+    u2_id = me_u2.json()["id"]
+
+    set_everyone = await client.put(
+        "/api/v1/users/profile",
+        headers={"Authorization": f"Bearer {u2['access_token']}"},
+        json={"privacy_private_messages": "everyone"},
+    )
+    assert set_everyone.status_code == 200
+
+    create_chat_allowed = await client.post(
+        "/api/v1/chats",
+        headers={"Authorization": f"Bearer {u1['access_token']}"},
+        json={"type": ChatType.PRIVATE.value, "title": None, "member_ids": [u2_id]},
+    )
+    assert create_chat_allowed.status_code == 200
+
+
 async def test_group_ban_blocks_rejoin(client, db_session):
     owner = await _create_verified_user(client, db_session, "ban_owner@example.com", "ban_owner", "strongpass123")
     member = await _create_verified_user(client, db_session, "ban_member@example.com", "ban_member", "strongpass123")