Prevent non-admin issue responses exposing account identities

2026-09-07 19:45:19 +12:00
parent 131b5fc5c7
commit 13edcb8136
3 changed files with 74 additions and 3 deletions
@@ -0,0 +1,33 @@
+import unittest
+from unittest.mock import patch
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+from backend.app.routers import portal
+
+
+class PortalPrivacyTests(unittest.TestCase):
+    def test_detail_and_comments_are_private_for_regular_users(self):
+        item = {'id': 1, 'kind': 'issue', 'title': 'Broken movie', 'status': 'new',
+                'created_by_username': 'private-reporter', 'created_by_id': 42,
+                'assignee_username': 'private-admin', 'metadata_json': '{"email":"secret@example.com"}',
+                'description': 'Contact private-reporter or secret@example.com', 'created_at': '2026-09-07'}
+        comment = {'id': 1, 'item_id': 1, 'author_username': 'private-admin', 'author_role': 'admin',
+                   'message': 'Sent to secret@example.com for private-reporter', 'is_internal': False}
+        app = FastAPI()
+        app.include_router(portal.router)
+        app.dependency_overrides[portal.get_current_user] = lambda: {'username': 'viewer', 'role': 'user'}
+        with patch.object(portal, 'get_portal_item', return_value=item), \
+             patch.object(portal, '_list_portal_comments', return_value=[comment]), \
+             patch.object(portal, 'list_portal_item_activity', return_value=[]), \
+             patch.object(portal, 'issue_resolution_state', return_value={}), \
+             patch.object(portal, 'get_all_users', return_value=[{'username': 'private-reporter', 'email': 'secret@example.com'}, {'username': 'private-admin'}]):
+            client = TestClient(app)
+            for path in ['/portal/items/1', '/portal/items/1/comments']:
+                response = client.get(path)
+                self.assertEqual(response.status_code, 200)
+                for secret in ['private-reporter', 'private-admin', 'secret@example.com', 'metadata_json', 'assignee_username', 'created_by_id']:
+                    self.assertNotIn(secret, response.text)
+            admin_result = portal._serialize_item(item, {'username': 'admin', 'role': 'admin'})
+            self.assertEqual(admin_result['created_by_username'], 'private-reporter')
+            own_result = portal._serialize_item(item, {'username': 'private-reporter', 'role': 'user'})
+            self.assertTrue(own_result['permissions']['can_edit'])