Refuse every repository when auth-file loses repos

A repos file the filter could not open read as listing nothing, so a
permission slip or a mistyped path made every protected repository
public. A line naming a repository with no groups was skipped the same
way, where auth-inline's empty list denies everyone.

2 files changed, 27 insertions, 11 deletions

diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.luaindex 3d426e9..aef7190 100644--- a/custom/extensions/auth-file.lua+++ b/custom/extensions/auth-file.lua@@ -64,7 +64,8 @@ local groups_filename = "/etc/cgit-auth/groups" -- Per-repository access lives one per line as reponame:group1,group2 and so -- on. A repository named here is protected and one that is not named is -- public. The repository name has to match exactly, while group and user names--- match regardless of case.+-- match regardless of case. While this file cannot be read every repository+-- is refused, since nothing then tells the protected ones apart. local repos_filename = "/etc/cgit-auth/repos"  -- Where the cookie-signing secret is stored, created on first use. It must be@@ -142,18 +143,20 @@ function repo_userset(repo) 		return nil 	end 	local groups = nil-	local repos_file = io.open(repos_filename, "r")-	if repos_file ~= nil then-		for line in repos_file:lines() do-			local name, list = string.match(line, "(.-):(.+)")-			if name ~= nil and trim(name) == repo then-				groups = {}-				add_names(list, groups)-				break-			end+	local repos_file, err = io.open(repos_filename, "r")+	if repos_file == nil then+		io.stderr:write("[cgit] Unable to read the auth repos file: " .. err .. "\n")+		return {}+	end+	for line in repos_file:lines() do+		local name, list = string.match(line, "(.-):(.*)")+		if name ~= nil and trim(name) == repo then+			groups = {}+			add_names(list, groups)+			break 		end-		repos_file:close() 	end+	repos_file:close() 	if groups == nil then 		return nil 	end
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index 3d426e9..aef7190 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -64,7 +64,8 @@ local groups_filename = "/etc/cgit-auth/groups"
 -- Per-repository access lives one per line as reponame:group1,group2 and so
 -- on. A repository named here is protected and one that is not named is
 -- public. The repository name has to match exactly, while group and user names
--- match regardless of case.
+-- match regardless of case. While this file cannot be read every repository
+-- is refused, since nothing then tells the protected ones apart.
 local repos_filename = "/etc/cgit-auth/repos"
 
 -- Where the cookie-signing secret is stored, created on first use. It must be
@@ -142,18 +143,20 @@ function repo_userset(repo)
 		return nil
 	end
 	local groups = nil
-	local repos_file = io.open(repos_filename, "r")
-	if repos_file ~= nil then
-		for line in repos_file:lines() do
-			local name, list = string.match(line, "(.-):(.+)")
-			if name ~= nil and trim(name) == repo then
-				groups = {}
-				add_names(list, groups)
-				break
-			end
+	local repos_file, err = io.open(repos_filename, "r")
+	if repos_file == nil then
+		io.stderr:write("[cgit] Unable to read the auth repos file: " .. err .. "\n")
+		return {}
+	end
+	for line in repos_file:lines() do
+		local name, list = string.match(line, "(.-):(.*)")
+		if name ~= nil and trim(name) == repo then
+			groups = {}
+			add_names(list, groups)
+			break
 		end
-		repos_file:close()
 	end
+	repos_file:close()
 	if groups == nil then
 		return nil
 	end
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.luaindex e9fed78..0025a81 100644--- a/tests/extensions/test-auth.lua+++ b/tests/extensions/test-auth.lua@@ -36,6 +36,7 @@ if variant == "file" then 	local repos_file = io.open("auth-repos", "w") 	repos_file:write("secret-repo:devs\n") 	repos_file:write("empty-repo:ghosts\n")+	repos_file:write("bare-repo:\n") 	repos_file:close() 	h.redirect_file("/etc/cgit-auth/users", "auth-users") 	h.redirect_file("/etc/cgit-auth/groups", "auth-groups")@@ -53,6 +54,7 @@ if variant == "inline" then 	local access = { 		["secret-repo"] = { alice = true, bob = true }, 		["empty-repo"] = {},+		["bare-repo"] = {}, 	} 	function account_hash(user) 		if user == nil then@@ -83,11 +85,22 @@ h.equals("the repository name matches case exactly", repo_userset("Secret-Repo") local empty = repo_userset("empty-repo") h.check("a protected repository with no members denies as an empty set", 	empty ~= nil and next(empty) == nil)+local bare = repo_userset("bare-repo")+h.check("a protected repository with no groups at all denies too",+	bare ~= nil and next(bare) == nil)  if variant == "file" then 	h.redirect_file("/etc/cgit-auth/users", "auth-users-missing") 	h.equals("a missing users file turns every login down", account_hash("alice"), nil) 	h.redirect_file("/etc/cgit-auth/users", "auth-users")+	-- Without the repos file nothing tells a protected repository from a+	-- public one, so every repository is refused while the index stays up.+	h.redirect_file("/etc/cgit-auth/repos", "auth-repos-missing")+	local refused = repo_userset("unlisted")+	h.check("a missing repos file refuses every repository",+		refused ~= nil and next(refused) == nil)+	h.equals("the index stays public all the same", repo_userset(nil), nil)+	h.redirect_file("/etc/cgit-auth/repos", "auth-repos") end  -- The url and cookie helpers.
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index e9fed78..0025a81 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -36,6 +36,7 @@ if variant == "file" then
 	local repos_file = io.open("auth-repos", "w")
 	repos_file:write("secret-repo:devs\n")
 	repos_file:write("empty-repo:ghosts\n")
+	repos_file:write("bare-repo:\n")
 	repos_file:close()
 	h.redirect_file("/etc/cgit-auth/users", "auth-users")
 	h.redirect_file("/etc/cgit-auth/groups", "auth-groups")
@@ -53,6 +54,7 @@ if variant == "inline" then
 	local access = {
 		["secret-repo"] = { alice = true, bob = true },
 		["empty-repo"] = {},
+		["bare-repo"] = {},
 	}
 	function account_hash(user)
 		if user == nil then
@@ -83,11 +85,22 @@ h.equals("the repository name matches case exactly", repo_userset("Secret-Repo")
 local empty = repo_userset("empty-repo")
 h.check("a protected repository with no members denies as an empty set",
 	empty ~= nil and next(empty) == nil)
+local bare = repo_userset("bare-repo")
+h.check("a protected repository with no groups at all denies too",
+	bare ~= nil and next(bare) == nil)
 
 if variant == "file" then
 	h.redirect_file("/etc/cgit-auth/users", "auth-users-missing")
 	h.equals("a missing users file turns every login down", account_hash("alice"), nil)
 	h.redirect_file("/etc/cgit-auth/users", "auth-users")
+	-- Without the repos file nothing tells a protected repository from a
+	-- public one, so every repository is refused while the index stays up.
+	h.redirect_file("/etc/cgit-auth/repos", "auth-repos-missing")
+	local refused = repo_userset("unlisted")
+	h.check("a missing repos file refuses every repository",
+		refused ~= nil and next(refused) == nil)
+	h.equals("the index stays public all the same", repo_userset(nil), nil)
+	h.redirect_file("/etc/cgit-auth/repos", "auth-repos")
 end
 
 -- The url and cookie helpers.