fix(tests): remove blind visibility, both teams always see each other's fields

Red and Blue could not see each other's real field data until both
reviews passed, showing a placeholder message instead. This kept
detection testing blind to what Red actually did; both sides now see
the full, live test data at all times.

backend/tests/test_blind_visibility.py

@@ -1,9 +1,10 @@
-"""Tests for red/blue blind visibility on GET /tests/{id}.
+"""Regression: Red and Blue must see each other's fields at every stage.
 
-Neither team should see the other team's data while a test is in
-draft/red_executing/red_review/blue_evaluating/blue_review. Both sides
-see everything once the test reaches in_review (and beyond). admin and
-viewer are never blinded.
+Blind visibility (hiding the other team's fields until both reviews pass)
+was a deliberate design in an earlier phase, but the org decided both teams
+should see each other's work throughout — detection testing isn't meant to
+be blind here. This confirms neither the frontend nor backend hides
+anything based on role/state anymore.
 """
 
 import uuid
@@ -46,11 +47,11 @@ def technique(api, auth_headers):
 
 
 @pytest.fixture
-def blind_test(client, db, api, red_lead_headers, red_lead_user, red_tech_headers, technique):
+def in_progress_test(client, db, api, red_lead_headers, red_lead_user, red_tech_headers, technique):
     """A test in red_executing with red-side content already filled in."""
     resp = api(
         "post", "/api/v1/tests", red_lead_headers,
-        json={"technique_id": technique, "name": "Blind visibility test"},
+        json={"technique_id": technique, "name": "Visibility test"},
     )
     test_id = resp.json()["id"]
 
@@ -62,32 +63,21 @@ def blind_test(client, db, api, red_lead_headers, red_lead_user, red_tech_header
     return test_id
 
 
-def test_blue_viewer_cannot_see_red_fields_during_red_executing(
-    client, db, api, blind_test, blue_tech_headers
+def test_blue_viewer_sees_red_fields_during_red_executing(
+    client, db, api, in_progress_test, blue_tech_headers
 ):
-    resp = api("get", f"/api/v1/tests/{blind_test}", blue_tech_headers)
+    resp = api("get", f"/api/v1/tests/{in_progress_test}", blue_tech_headers)
     assert resp.status_code == 200
     body = resp.json()
-    for field in _RED_FIELDS:
-        assert body[field] is None, f"{field} should be hidden from blue viewer"
-
-
-def test_red_viewer_cannot_see_blue_fields_during_red_executing(
-    client, db, api, blind_test, red_tech_headers
-):
-    resp = api("get", f"/api/v1/tests/{blind_test}", red_tech_headers)
-    assert resp.status_code == 200
-    body = resp.json()
-    for field in _BLUE_FIELDS:
-        assert body[field] is None, f"{field} should be hidden from red viewer"
-    # Red's own fields ARE visible to red
     assert body["procedure_text"] == "run mimikatz"
+    assert body["tool_used"] == "mimikatz"
+    assert body["red_summary"] == "dumped creds"
 
 
-def test_admin_sees_everything_during_blind_states(
-    client, db, api, blind_test, auth_headers
+def test_red_viewer_sees_own_fields_during_red_executing(
+    client, db, api, in_progress_test, red_tech_headers
 ):
-    resp = api("get", f"/api/v1/tests/{blind_test}", auth_headers)
+    resp = api("get", f"/api/v1/tests/{in_progress_test}", red_tech_headers)
     assert resp.status_code == 200
     body = resp.json()
     assert body["procedure_text"] == "run mimikatz"
@@ -95,9 +85,9 @@ def test_admin_sees_everything_during_blind_states(
 
 def test_both_sides_see_everything_once_in_review(
     client, db, api, auth_headers, red_tech_headers, red_lead_headers,
-    blue_tech_headers, blue_lead_headers, red_lead_user, blue_lead_user, blind_test,
+    blue_tech_headers, blue_lead_headers, red_lead_user, blue_lead_user, in_progress_test,
 ):
-    test_id = blind_test
+    test_id = in_progress_test
     _add_evidence(db, test_id, TeamSide.red)
     submit_red = api("post", f"/api/v1/tests/{test_id}/submit-red", red_tech_headers)
     assert submit_red.status_code == 200, submit_red.text