fix: restrict user email visibility

Co-Authored-By: gpt-5.6-sol <noreply@openai.com>
2026-07-23 18:49:49 +00:00
parent d7e31dfce9
commit a1992eb57a
4 changed files with 232 additions and 5 deletions
@@ -17,7 +17,9 @@ async function getApiDb() {
    email: AUTH_EMAIL,
    name: "API Auth User",
    password: pw,
-    flags: {},
+    // The shared backend contract suite exercises unrestricted user lookup,
+    // which the HTTP API now reserves for global administrators.
+    flags: { admin: true },
  });
  const server = await createTestServer(sqliteDb);
  const authHeader = "Basic " + btoa(`${AUTH_EMAIL}:${AUTH_PASSWORD}`);