Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Check how auth groups resolve to members
auth-file.lua says group names match whatever their case, but both
fixture files spelt devs alike, so dropping either lowercasing passed.
No repository named two groups and no user sat in two, so reading only
the first group of a list, or only the last line that matched, passed
as well. A repository with no groups at all is a file variant matter,
and for the inline one the check only repeated the empty one.
| -rw-r--r-- | tests/extensions/test-auth.lua | 24 |
1 file changed, 16 insertions, 8 deletions
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index 86f8f89..1531040 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -39,11 +39,12 @@ if variant == "file" then users_file:write("carol:" .. stored_hash .. "\n") users_file:close() local groups_file = io.open(directory .. "/auth-groups", "w") - groups_file:write("devs:Alice, bob\n") - groups_file:write("others:carol\n") + groups_file:write("DEVS:Alice, bob\n") + groups_file:write("others:carol, alice\n") groups_file:close() local repos_file = io.open(directory .. "/auth-repos", "w") - repos_file:write("secret-repo:devs\n") + repos_file:write("secret-repo:Devs\n") + repos_file:write("both-repo:devs,others\n") repos_file:write("empty-repo:ghosts\n") repos_file:write("bare-repo:\n") repos_file:close() @@ -57,8 +58,8 @@ end local inline_config = { { "local protected_repos = {\n", "local protected_repos = {\n" .. "\t[\"secret-repo\"] = { alice = true, Bob = true },\n" .. - "\t[\"empty-repo\"] = {},\n" .. - "\t[\"bare-repo\"] = {},\n" }, + "\t[\"both-repo\"] = { alice = true, bob = true, carol = true },\n" .. + "\t[\"empty-repo\"] = {},\n" }, { "local users = {\n", "local users = {\n" .. "\tAlice = \"" .. stored_hash .. "\",\n" .. "\tcarol = \"" .. stored_hash .. "\",\n" }, @@ -190,9 +191,14 @@ h.equals("the repository name matches case exactly", repo_userset("Secret-Repo") local empty = repo_userset("empty-repo") h.check("a protected repository with no members denies as an empty set", empty ~= nil and next(empty) == nil) -local bare = repo_userset("bare-repo") -h.check("a protected repository with no groups at all denies too", - bare ~= nil and next(bare) == nil) +local both = repo_userset("both-repo") +h.check("a repository of two groups lets in the members of each", + both ~= nil and both.alice and both.bob and both.carol) +if variant == "file" then + local bare = repo_userset("bare-repo") + h.check("a protected repository with no groups at all denies too", + bare ~= nil and next(bare) == nil) +end if variant == "file" then h.redirect_file("/etc/cgit-auth/users", directory .. "/auth-users-missing") @@ -414,6 +420,7 @@ h.equals("a session signed without its binding does not verify", validate_value("username", unbound, account_hash), nil) h.equals("a memberless repository denies even a valid session", visit("empty-repo", session), 0) +h.equals("a repository of two groups lets in a member of the first", visit("both-repo", session), 1) if variant == "file" then h.redirect_file("/etc/cgit-auth/groups", directory .. "/auth-groups-missing") h.equals("as does one whose groups file is missing", visit("secret-repo", session), 0) @@ -422,6 +429,7 @@ end local outsider = secure_value("username", "carol", now + 3600, stored_hash) h.equals("a signed session for an outsider is turned away", visit("secret-repo", outsider), 0) +h.equals("while one in the second group lets them in", visit("both-repo", outsider), 1) local forged = session:sub(1, -2) .. (session:sub(-1) == "0" and "1" or "0") h.equals("a forged session is turned away", visit("secret-repo", forged), 0) |