test: add tests for redacted fields

program/tests/test_profiles.py

@@ -99,3 +99,13 @@ def test_update_profile_forbidden_for_common_user(common_api_client1, profile):
     response = common_api_client1.put(url(profile), data=update)
 
     assert response.status_code == 403
+
+
+def test_redacted_fields_for_unauthenticated_requests(api_client, profile):
+    response = api_client.get(url(profile))
+    data = response.json()
+
+    assert response.status_code == 200
+
+    assert "email" not in data
+    assert "cba" not in data

program/tests/test_shows.py

@@ -176,3 +176,22 @@ def test_update_show_forbidden_for_common_user(
     response = common_api_client1.patch(url(show), data=update, format="json")
 
     assert response.status_code == 403
+
+
+def test_redacted_fields_for_unauthenticated_requests(api_client, show):
+    response = api_client.get(url(show))
+    data = response.json()
+
+    assert response.status_code == 200
+
+    assert "email" not in data
+    assert "internal_note" not in data
+
+
+def test_redacted_fields_for_common_user(common_api_client1, show):
+    response = common_api_client1.get(url(show))
+    data = response.json()
+
+    assert response.status_code == 200
+
+    assert "internal_note" not in data

program/tests/test_timeslots.py

@@ -87,3 +87,12 @@ def test_update_timeslot_forbidden_as_unauthenticated(api_client, once_timeslot)
     response = api_client.put(url(timeslot=once_timeslot), data=update)
 
     assert response.status_code == 403
+
+
+def test_redacted_field_for_unauthenticated_requests(api_client, once_timeslot):
+    response = api_client.get(url(timeslot=once_timeslot))
+    data = response.json()
+
+    assert response.status_code == 200
+
+    assert "memo" not in data