Pablan, as it stands

Self-hosted knowledge management for SMEs: a split-screen Markdown editor
whose sections an LLM refines while you write, and RAG question answering
over the documents that result. FastAPI + Postgres/pgvector on the back,
SvelteKit on the front, everything OpenAI-compatible and self-hostable.

Squashed into a single commit; the development history stays local.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CA43ZJda8Rbp2hKXNy8f6b

backend/tests/test_people.py

@@ -0,0 +1,44 @@
+"""The colleague directory: member-visible, permission-safe, no credentials."""
+
+from httpx import AsyncClient
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models import User
+
+
+async def _login(client: AsyncClient, email: str = "pablo@test.dev") -> None:
+    response = await client.post(
+        "/api/auth/login", json={"email": email, "password": "secret123"}
+    )
+    assert response.status_code == 200
+
+
+async def test_directory_lists_colleagues_without_leaking_credentials(
+    client: AsyncClient, seeded_user: User, seeded_admin: User
+) -> None:
+    await _login(client)
+    people = (await client.get("/api/people")).json()
+    names = {person["name"] for person in people}
+    assert {"Pablo Test", "Florian Test"} <= names
+    # No email or password ever leaves the directory.
+    assert all("email" not in p and "password_hash" not in p for p in people)
+
+    pablo = next(p for p in people if p["name"] == "Pablo Test")
+    assert pablo["department"] == "Engineering"
+    assert pablo["role"] == "member"
+
+
+async def test_directory_requires_a_session(client: AsyncClient) -> None:
+    assert (await client.get("/api/people")).status_code == 401
+
+
+async def test_person_detail_and_unknown_is_404(
+    client: AsyncClient, db: AsyncSession, seeded_user: User
+) -> None:
+    await _login(client)
+    ok = await client.get(f"/api/people/{seeded_user.id}")
+    assert ok.status_code == 200
+    assert ok.json()["name"] == "Pablo Test"
+
+    missing = await client.get("/api/people/00000000-0000-0000-0000-000000000000")
+    assert missing.status_code == 404