test(privacy): extend avatar and presence matrix coverage

tests/test_chat_message_flow.py

@@ -927,3 +927,83 @@ async def test_private_chat_contacts_privacy_reveals_avatar_and_presence_for_all
     assert row_after is not None
     assert row_after["counterpart_avatar_url"] == "https://cdn.example.com/privacy-contacts-owner.png"
     assert row_after["counterpart_is_online"] is not None
+
+
+async def test_avatar_privacy_contacts_in_search_visible_only_for_contacts(client, db_session):
+    owner = await _create_verified_user(client, db_session, "avatar_contacts_owner@example.com", "avatar_contacts_owner", "strongpass123")
+    viewer = await _create_verified_user(client, db_session, "avatar_contacts_viewer@example.com", "avatar_contacts_viewer", "strongpass123")
+
+    me_viewer = await client.get("/api/v1/auth/me", headers={"Authorization": f"Bearer {viewer['access_token']}"})
+    viewer_id = me_viewer.json()["id"]
+
+    set_avatar_and_privacy = await client.put(
+        "/api/v1/users/profile",
+        headers={"Authorization": f"Bearer {owner['access_token']}"},
+        json={"avatar_url": "https://cdn.example.com/avatar-contacts-owner.png", "privacy_avatar": "contacts"},
+    )
+    assert set_avatar_and_privacy.status_code == 200
+
+    search_before_contact = await client.get(
+        "/api/v1/users/search",
+        params={"query": "avatar_contacts_owner", "limit": 20},
+        headers={"Authorization": f"Bearer {viewer['access_token']}"},
+    )
+    assert search_before_contact.status_code == 200
+    rows_before = search_before_contact.json()
+    owner_before = next((item for item in rows_before if item["username"] == "avatar_contacts_owner"), None)
+    assert owner_before is not None
+    assert owner_before["avatar_url"] is None
+
+    add_contact = await client.post(
+        f"/api/v1/users/{viewer_id}/contacts",
+        headers={"Authorization": f"Bearer {owner['access_token']}"},
+    )
+    assert add_contact.status_code == 204
+
+    search_after_contact = await client.get(
+        "/api/v1/users/search",
+        params={"query": "avatar_contacts_owner", "limit": 20},
+        headers={"Authorization": f"Bearer {viewer['access_token']}"},
+    )
+    assert search_after_contact.status_code == 200
+    rows_after = search_after_contact.json()
+    owner_after = next((item for item in rows_after if item["username"] == "avatar_contacts_owner"), None)
+    assert owner_after is not None
+    assert owner_after["avatar_url"] == "https://cdn.example.com/avatar-contacts-owner.png"
+
+
+async def test_private_chat_everyone_privacy_reveals_avatar_and_presence_without_contacts(client, db_session):
+    owner = await _create_verified_user(client, db_session, "privacy_everyone_owner@example.com", "privacy_everyone_owner", "strongpass123")
+    viewer = await _create_verified_user(client, db_session, "privacy_everyone_viewer@example.com", "privacy_everyone_viewer", "strongpass123")
+
+    me_owner = await client.get("/api/v1/auth/me", headers={"Authorization": f"Bearer {owner['access_token']}"})
+    owner_id = me_owner.json()["id"]
+
+    set_privacy = await client.put(
+        "/api/v1/users/profile",
+        headers={"Authorization": f"Bearer {owner['access_token']}"},
+        json={
+            "avatar_url": "https://cdn.example.com/privacy-everyone-owner.png",
+            "privacy_avatar": "everyone",
+            "privacy_last_seen": "everyone",
+        },
+    )
+    assert set_privacy.status_code == 200
+
+    create_chat = await client.post(
+        "/api/v1/chats",
+        headers={"Authorization": f"Bearer {viewer['access_token']}"},
+        json={"type": ChatType.PRIVATE.value, "title": None, "member_ids": [owner_id]},
+    )
+    assert create_chat.status_code == 200
+    chat_id = create_chat.json()["id"]
+
+    viewer_chats = await client.get(
+        "/api/v1/chats",
+        headers={"Authorization": f"Bearer {viewer['access_token']}"},
+    )
+    assert viewer_chats.status_code == 200
+    row = next((chat for chat in viewer_chats.json() if chat["id"] == chat_id), None)
+    assert row is not None
+    assert row["counterpart_avatar_url"] == "https://cdn.example.com/privacy-everyone-owner.png"
+    assert row["counterpart_is_online"] is not None