def test_api_challenges_admins_can_bypass_requirements():
    """Test that admins can bypass requirements checks with admin capabilities and view-admin"""
    app = create_ctfd()
    with app.app_context():
        # Create challenges
        prereq_id = gen_challenge(app.db).id
        chal_obj = gen_challenge(app.db)
        chal_obj.requirements = {"prerequisites": [prereq_id]}

        register_user(app)
        # Confirm that regular users cannot see prerequisites
        with login_as_user(app) as client:
            # Locked challenges aren't shown
            r = client.get("/api/v1/challenges")
            assert r.status_code == 200
            data = r.get_json()["data"]
            assert len(data) == 1
            assert data[0]["id"] == 1

            # Not even with tricks
            r = client.get("/api/v1/challenges?view=admin")
            assert r.status_code == 200
            data = r.get_json()["data"]
            assert len(data) == 1
            assert data[0]["id"] == 1

            # Not even with forced browsing
            r = client.get("/api/v1/challenges/2")
            assert r.status_code == 403

        # Confirm that admins
        with login_as_user(app, name="admin") as admin:
            # Admins see as regular users
            r = admin.get("/api/v1/challenges")
            assert r.status_code == 200
            data = r.get_json()["data"]
            assert len(data) == 1
            assert data[0]["id"] == 1

            # Now admins can see all challenges
            r = admin.get("/api/v1/challenges?view=admin")
            assert r.status_code == 200
            data = r.get_json()["data"]
            assert len(data) == 2
            assert data[0]["id"] == 1
            assert data[1]["id"] == 2

            # Admins can force browse to challenges
            r = admin.get("/api/v1/challenges/2")
            assert r.status_code == 200
            assert r.get_json()["data"]
    destroy_ctfd(app)
Test that admins can bypass requirements checks with admin capabilities and view-admin
tests/api/v1/challenges/requirements/test_requirements.py