Add ability to hide posts from unregistered users.

test_post_visibility.py

@@ -0,0 +1,57 @@
+import tempfile
+import unittest
+from pathlib import Path
+
+import app as application
+from werkzeug.security import generate_password_hash
+
+
+class PostVisibilityTestCase(unittest.TestCase):
+    def setUp(self):
+        self.temp_directory = tempfile.TemporaryDirectory()
+        self.database_path = Path(self.temp_directory.name) / "test.db"
+        self.original_config = application.app.config.copy()
+        application.app.config.update(DATABASE=self.database_path, TESTING=True, WTF_CSRF_ENABLED=False)
+        with application.app.app_context():
+            application.init_db()
+            db = application.get_db()
+            self.user_id = db.execute(
+                """INSERT INTO users (username, real_name, email, email_verified, password_hash, created_at, is_approved, role, mfa_enabled)
+                   VALUES (?, ?, ?, 1, ?, ?, 1, 'member', 1)""",
+                ("member", "Member Name", "member@example.com", generate_password_hash("secure-password"), "2026-09-01T00:00:00+00:00"),
+            ).lastrowid
+            db.commit()
+        self.client = application.app.test_client()
+
+    def tearDown(self):
+        application.app.config.update(self.original_config)
+        self.temp_directory.cleanup()
+
+    def test_member_only_post_is_hidden_from_anonymous_visitors(self):
+        with self.client.session_transaction() as session:
+            session["user_id"] = self.user_id
+            session["mfa_verified"] = True
+
+        response = self.client.post(
+            "/write",
+            data={"title": "Member transmission", "category": "Engineering", "excerpt": "Members only.", "body": "Private body.", "is_hidden": "1"},
+        )
+        self.assertEqual(response.status_code, 302)
+        with application.app.app_context():
+            self.assertEqual(application.get_db().execute("SELECT is_hidden FROM posts WHERE slug = ?", ("member-transmission",)).fetchone()[0], 1)
+
+        self.client.get("/logout")
+        with self.client.session_transaction() as session:
+            session.clear()
+        self.assertNotIn(b"Member transmission", self.client.get("/").data)
+        self.assertEqual(self.client.get("/post/member-transmission").status_code, 404)
+
+        with self.client.session_transaction() as session:
+            session["user_id"] = self.user_id
+            session["mfa_verified"] = True
+        self.assertIn(b"Member transmission", self.client.get("/").data)
+        self.assertEqual(self.client.get("/post/member-transmission").status_code, 200)
+
+
+if __name__ == "__main__":
+    unittest.main()