def test_api_challenges_challenge_with_requirements_hidden_user():
    """Does the challenge list API show gated challenges to a hidden user?"""
    app = create_ctfd()
    with app.app_context():
        prereq_id = gen_challenge(app.db).id
        chal_obj = gen_challenge(app.db)
        chal_obj.requirements = {"prerequisites": [prereq_id]}
        chal_id = chal_obj.id
        # Create a new user which will solve the prerequisite and hide them
        register_user(app)
        Users.query.get(2).hidden = True
        app.db.session.commit()
        # Confirm that only the prerequisite challenge is listed initially
        with login_as_user(app) as client:
            r = client.get("/api/v1/challenges")
            assert r.status_code == 200
            (chal_data,) = r.get_json()["data"]
            assert chal_data["id"] == prereq_id
        # Generate a solve and then confirm the second challenge is visible
        gen_solve(app.db, user_id=2, challenge_id=prereq_id)
        with login_as_user(app) as client:
            r = client.get("/api/v1/challenges")
            assert r.status_code == 200
            data = r.get_json()["data"]
            assert len(data) == 2
            chal_ids = {c["id"] for c in r.get_json()["data"]}
            assert chal_ids == {prereq_id, chal_id}
    destroy_ctfd(app)
Does the challenge list API show gated challenges to a hidden user?
tests/api/v1/challenges/requirements/test_requirements.py