From 131e7d1c87c5647d6679d7833aa721f6040cf513 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 13 2021 14:28:29 +0000
Subject: Add a test checking we don't leak information about private projects


Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/tests/test_pagure_flask_api_project_contributors.py b/tests/test_pagure_flask_api_project_contributors.py
index c40154f..fe7021d 100644
--- a/tests/test_pagure_flask_api_project_contributors.py
+++ b/tests/test_pagure_flask_api_project_contributors.py
@@ -47,6 +47,21 @@ class PagureFlaskApiProjectContributorsTests(tests.SimplePagureTest):
         tests.create_projects(self.session)
         tests.create_projects_git(os.path.join(self.path, "repos"), bare=True)
 
+    def test_private_project(self):
+        project = pagure.lib.query.get_authorized_project(self.session, "test")
+        project.private = True
+        self.session.add(project)
+        self.session.commit()
+
+        output = self.app.get("/api/0/test/contributors")
+        self.assertEqual(output.status_code, 404)
+        expected_rv = {
+            "error": "Project not found",
+            "error_code": "ENOPROJECT",
+        }
+        data = json.loads(output.get_data(as_text=True))
+        self.assertDictEqual(data, expected_rv)
+
     def test_just_main_admin(self):
 
         output = self.app.get("/api/0/test/contributors")