def test_api_challenge_get_solve_info_account_visibility():
    """Does the challenge detail API show solve info if accounts are hidden?"""
    app = create_ctfd()
    with app.app_context(), app.test_client() as pub_client:
        set_config("challenge_visibility", "public")
        # Generate a challenge, user and solve to test the API with
        chal_id = gen_challenge(app.db).id
        chal_uri = "/api/v1/challenges/{}".format(chal_id)
        register_user(app)
        gen_solve(app.db, user_id=2, challenge_id=chal_id)

        #  With the public setting any unauthed user should see the solve
        set_config("account_visibility", "public")
        r = pub_client.get(chal_uri)
        assert r.status_code == 200
        chal_data = r.get_json()["data"]
        assert chal_data["solves"] == 1
        assert chal_data["solved_by_me"] is False

        # With the private setting only an authed user should see the solve
        set_config("account_visibility", "private")
        # Test public user
        r = pub_client.get(chal_uri)
        assert r.status_code == 200
        chal_data = r.get_json()["data"]
        assert chal_data["solves"] is None
        assert chal_data["solved_by_me"] is False
        # Test user
        user_client = login_as_user(app)
        r = user_client.get(chal_uri)
        assert r.status_code == 200
        chal_data = r.get_json()["data"]
        assert chal_data["solves"] == 1
        assert chal_data["solved_by_me"] is True

        # With the admins setting only admins should see the solve
        set_config("account_visibility", "admins")
        # Test user
        r = user_client.get(chal_uri)
        assert r.status_code == 200
        chal_data = r.get_json()["data"]
        assert chal_data["solves"] is None
        assert chal_data["solved_by_me"] is True
        # Test admin user
        admin_client = login_as_user(app, "admin", "password")
        r = admin_client.get(chal_uri)
        assert r.status_code == 200
        chal_data = r.get_json()["data"]
        assert chal_data["solves"] == 1
        assert chal_data["solved_by_me"] is False

        # With the hidden setting admins can still see the solve
        # because the challenge detail endpoint doesn't have an admin specific view
        set_config("account_visibility", "hidden")
        r = admin_client.get(chal_uri)
        assert r.status_code == 200
        chal_data = r.get_json()["data"]
        assert chal_data["solves"] == 1
    destroy_ctfd(app)
Does the challenge detail API show solve info if accounts are hidden?
tests/api/v1/test_challenges.py