feat: publish CodexPi contest snapshot

tests/test_search.py

@@ -0,0 +1,51 @@
+from __future__ import annotations
+
+
+def register_project(client, headers, root, name: str) -> dict:
+    root.mkdir()
+    response = client.post(
+        "/api/projects",
+        headers=headers,
+        json={"name": name, "path": str(root)},
+    )
+    assert response.status_code == 201
+    return response.json()
+
+
+def test_global_search_finds_owned_content_and_respects_user_scope(logged_in):
+    client, app, projects, _, admin_headers = logged_in
+    television = register_project(client, admin_headers, projects / "television-admin", "Télévision salon")
+    receiver = register_project(client, admin_headers, projects / "receiver-admin", "Récepteur multimédia")
+    conversation = client.post(
+        f"/api/projects/{television['id']}/conversations",
+        headers=admin_headers,
+        json={"title": "Contrat HDMI partagé"},
+    )
+    assert conversation.status_code == 201
+    group = client.post(
+        "/api/project-groups",
+        headers=admin_headers,
+        json={"name": "Groupe TV", "description": "Projets connectés à la télévision", "project_ids": [television["id"], receiver["id"]]},
+    )
+    assert group.status_code == 201
+
+    admin_results = client.get("/api/search", params={"q": "HDMI"}).json()
+    assert [(item["kind"], item["label"]) for item in admin_results] == [("conversation", "Contrat HDMI partagé")]
+    assert any(item["kind"] == "group" for item in client.get("/api/search", params={"q": "Groupe TV"}).json())
+    assert client.get("/api/search", params={"q": "T"}).json() == []
+
+    app.state.auth.create_user("member", "a-different-long-test-password", is_admin=False)
+    assert client.post("/api/auth/logout", headers=admin_headers).status_code == 200
+    login = client.post(
+        "/api/auth/login",
+        json={"username": "member", "password": "a-different-long-test-password"},
+    )
+    assert login.status_code == 200
+    member_headers = {"X-CSRF-Token": login.json()["csrf_token"]}
+    own = register_project(client, member_headers, projects / "television-member", "Télévision personnelle")
+
+    member_results = client.get("/api/search", params={"q": "Télévision"}).json()
+    assert [(item["kind"], item["id"]) for item in member_results] == [("project", own["id"])]
+    assert all(item["id"] != television["id"] for item in member_results)
+    assert not any(item["kind"] == "group" for item in member_results)
+