Load auth libraries only when a request needs one

Required at the top, a missing luaossl or luaposix failed every request
to the site, public pages included, and each public page paid to load
both.

1 file changed, 13 insertions, 0 deletions

diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.luaindex e0d2fe5..eb402da 100644--- a/tests/extensions/test-auth.lua+++ b/tests/extensions/test-auth.lua@@ -328,4 +328,17 @@ out, ret = run_action("authenticate-post", { }) h.contains("even a signed unsafe destination is not followed", out, "Status: 404") +-- The libraries load only once a request needs one, so with every one of+-- them gone a public repository is still served, while a protected one+-- fails closed instead of reaching its content.+for _, name in ipairs({ "openssl.rand", "openssl.hmac", "posix.sys.stat", "posix.unistd" }) do+	package.loaded[name] = nil+	h.preload_failure(name)+end+out, ret = run_action("authenticate-cookie", { repo = "unlisted" })+h.equals("without the libraries a public repository is served", ret, 1)+h.check("while a protected one fails closed", not pcall(run_action,+	"authenticate-cookie", { repo = "secret-repo", cookie = "cgitauth=" .. session }))+h.check("and so does its login form", not pcall(run_action, "body", {}))+ h.finish()
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index e0d2fe5..eb402da 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -328,4 +328,17 @@ out, ret = run_action("authenticate-post", {
 })
 h.contains("even a signed unsafe destination is not followed", out, "Status: 404")
 
+-- The libraries load only once a request needs one, so with every one of
+-- them gone a public repository is still served, while a protected one
+-- fails closed instead of reaching its content.
+for _, name in ipairs({ "openssl.rand", "openssl.hmac", "posix.sys.stat", "posix.unistd" }) do
+	package.loaded[name] = nil
+	h.preload_failure(name)
+end
+out, ret = run_action("authenticate-cookie", { repo = "unlisted" })
+h.equals("without the libraries a public repository is served", ret, 1)
+h.check("while a protected one fails closed", not pcall(run_action,
+	"authenticate-cookie", { repo = "secret-repo", cookie = "cgitauth=" .. session }))
+h.check("and so does its login form", not pcall(run_action, "body", {}))
+
 h.finish()