From aaae5b313ea96a0938a591c738d6b57c5d9b30bf Mon Sep 17 00:00:00 2001 From: benya Date: Sun, 8 Mar 2026 20:20:47 +0300 Subject: [PATCH] test(privacy): enforce nobody group-invite policy --- docs/core-checklist-status.md | 2 +- tests/test_chat_message_flow.py | 30 ++++++++++++++++++++++++++++++ 2 files changed, 31 insertions(+), 1 deletion(-) diff --git a/docs/core-checklist-status.md b/docs/core-checklist-status.md index 73b4935..24d4549 100644 --- a/docs/core-checklist-status.md +++ b/docs/core-checklist-status.md @@ -37,7 +37,7 @@ Legend: 28. Notifications - `PARTIAL` (browser notifications + mute/settings; no mobile push infra) 29. Archive - `DONE` 30. Blacklist - `DONE` -31. Privacy - `PARTIAL` (avatar/last-seen/group-invites + PM policy `everyone|contacts|nobody`; integration tests cover PM policy `contacts/nobody` and private chat counterpart visibility for `nobody/contacts`, remaining UX/matrix hardening) +31. Privacy - `PARTIAL` (avatar/last-seen/group-invites + PM policy `everyone|contacts|nobody`; integration tests cover PM policy `contacts/nobody`, group-invite policy `contacts/nobody`, and private chat counterpart visibility for `nobody/contacts`, remaining UX/matrix hardening) 32. Security - `PARTIAL` (sessions + revoke + 2FA base + access-session visibility; integration tests cover single-session revoke and revoke-all invalidation/force-disconnect; 2FA setup now blocked after enable to prevent secret re-issuance; one-time recovery codes added; UX polish ongoing) 33. Realtime Events - `DONE` (connect/disconnect/send/receive/typing/read/delivered/online/offline + chat/message updates + chat_deleted) 34. Sync - `PARTIAL` (cross-device via backend state + realtime; reconciliation improved for loaded chats/messages, chat-info panel hot-refreshes on `chat_updated`, delete/leave updates realtime subscriptions, full-chat delete emits `chat_deleted`) diff --git a/tests/test_chat_message_flow.py b/tests/test_chat_message_flow.py index d778d99..e9c865c 100644 --- a/tests/test_chat_message_flow.py +++ b/tests/test_chat_message_flow.py @@ -559,6 +559,36 @@ async def test_group_invite_privacy_contacts_only(client, db_session): assert create_group_allowed.status_code == 200 +async def test_group_invite_privacy_nobody_blocks_invites_even_from_contacts(client, db_session): + inviter = await _create_verified_user(client, db_session, "invite_nobody_u1@example.com", "invite_nobody_u1", "strongpass123") + target = await _create_verified_user(client, db_session, "invite_nobody_u2@example.com", "invite_nobody_u2", "strongpass123") + + me_inviter = await client.get("/api/v1/auth/me", headers={"Authorization": f"Bearer {inviter['access_token']}"}) + me_target = await client.get("/api/v1/auth/me", headers={"Authorization": f"Bearer {target['access_token']}"}) + inviter_id = me_inviter.json()["id"] + target_id = me_target.json()["id"] + + set_nobody = await client.put( + "/api/v1/users/profile", + headers={"Authorization": f"Bearer {target['access_token']}"}, + json={"privacy_group_invites": "nobody"}, + ) + assert set_nobody.status_code == 200 + + add_contact = await client.post( + f"/api/v1/users/{inviter_id}/contacts", + headers={"Authorization": f"Bearer {target['access_token']}"}, + ) + assert add_contact.status_code == 204 + + create_group_blocked = await client.post( + "/api/v1/chats", + headers={"Authorization": f"Bearer {inviter['access_token']}"}, + json={"type": ChatType.GROUP.value, "title": "Nobody blocked group", "member_ids": [target_id]}, + ) + assert create_group_blocked.status_code == 403 + + async def test_avatar_privacy_hidden_from_other_users_search(client, db_session): owner = await _create_verified_user(client, db_session, "avatar_owner@example.com", "avatar_owner", "strongpass123") viewer = await _create_verified_user(client, db_session, "avatar_viewer@example.com", "avatar_viewer", "strongpass123")