def test_api_accessing_hidden_users():
    """Hidden users should not be visible to normal users, only to admins"""
    app = create_ctfd()
    with app.app_context():
        register_user(app, name="visible_user", email="visible_user@examplectf.com")
        register_user(
            app, name="hidden_user", email="hidden_user@examplectf.com"
        )  # ID 3
        user = Users.query.filter_by(name="hidden_user").first()
        user.hidden = True
        app.db.session.commit()

        with login_as_user(app, name="visible_user") as client:
            list_users = client.get("/api/v1/users").get_json()["data"]
            assert len(list_users) == 1

            assert client.get("/api/v1/users/3").status_code == 404
            assert client.get("/api/v1/users/3/solves").status_code == 404
            assert client.get("/api/v1/users/3/fails").status_code == 404
            assert client.get("/api/v1/users/3/awards").status_code == 404

        with login_as_user(app, name="admin") as client:
            # Admins see the user in lists
            list_users = client.get("/api/v1/users?view=admin").get_json()["data"]
            assert len(list_users) == 3

            assert client.get("/api/v1/users/3").status_code == 200
            assert client.get("/api/v1/users/3/solves").status_code == 200
            assert client.get("/api/v1/users/3/fails").status_code == 200
            assert client.get("/api/v1/users/3/awards").status_code == 200
    destroy_ctfd(app)
Hidden users should not be visible to normal users, only to admins
tests/api/v1/test_users.py