Load auth libraries only when a request needs one

Required at the top, a missing luaossl or luaposix failed every request
to the site, public pages included, and each public page paid to load
both.

1 file changed, 30 insertions, 6 deletions

diff --git a/tests/t0505-auth.sh b/tests/t0505-auth.shindex 2ebee10..526840d 100755--- a/tests/t0505-auth.sh+++ b/tests/t0505-auth.sh@@ -4,9 +4,9 @@ # differ only in where accounts live. The unit checks meet luaossl and # luaposix with deterministic stand-ins from the harness, proving tampered # and expired cookies turned away, header injection stripped, unsafe-# redirects refused and the login flows answering as documented. The run-# through cgit itself needs the real modules inside the binary's own Lua, so-# it is probed for, and proves an unedited copy protects nothing.+# redirects refused and the login flows answering as documented. Through cgit+# itself an unedited copy protects nothing, with or without the modules, and+# when the binary's own Lua lacks them a protected repository stays closed.  test_description='Check the shipped auth extensions' CGIT_TEST_NO_CREATE_REPOS=YesPlease@@ -41,11 +41,16 @@ if test "$CGIT_HAS_LUA" -eq 1 && 	cgit_lua_probe "$PWD/repos/authy/.git" openssl.rand openssl.hmac posix.sys.stat posix.unistd then 	test_set_prereq CGIT_LUA_AUTH+elif test "$CGIT_HAS_LUA" -eq 1+then+	test_set_prereq CGIT_LUA_NOAUTH+	say 'cgit lua lacks luaossl or luaposix, expecting protected pages refused' else-	say 'cgit lua lacks luaossl or luaposix, checks through cgit skipped'+	say 'cgit built without lua, checks through cgit skipped' fi+test "$CGIT_HAS_LUA" -eq 1 && test_set_prereq CGIT_LUA -test_expect_success CGIT_LUA_AUTH 'point cgit at the unedited auth filter' '+test_expect_success CGIT_LUA 'point cgit at the unedited auth filter' ' 	cat >cgitrc <<-EOF 	virtual-root=/ 	cache-size=0@@ -55,9 +60,28 @@ test_expect_success CGIT_LUA_AUTH 'point cgit at the unedited auth filter' ' 	EOF ' -test_expect_success CGIT_LUA_AUTH 'an unedited copy protects nothing' '+test_expect_success CGIT_LUA 'an unedited copy protects nothing' ' 	cgit_url "authy/log/" >tmp && 	grep ">guarded commit</a>" tmp ' +test_expect_success CGIT_LUA_NOAUTH 'without the modules a protected repository stays closed' '+	cat >protect.awk <<-\EOF &&+	{ print }+	/^local protected_repos = [{]$/ { print "\t[\"authy\"] = { alice = true }," }+	EOF+	awk -f protect.awk "$EXTENSIONS_DIRECTORY/auth-inline.lua" >guarded.lua &&+	grep "\"authy\"" guarded.lua &&+	cat >guardedrc <<-EOF &&+	virtual-root=/+	cache-size=0+	auth-filter=lua:$PWD/guarded.lua+	repo.url=authy+	repo.path=$PWD/repos/authy/.git+	EOF+	CGIT_CONFIG="$PWD/guardedrc" QUERY_STRING="url=authy/log/" cgit >tmp &&+	! grep "guarded commit" tmp &&+	grep "Unable to complete the request" tmp+'+ test_done
diff --git a/tests/t0505-auth.sh b/tests/t0505-auth.sh
index 2ebee10..526840d 100755
--- a/tests/t0505-auth.sh
+++ b/tests/t0505-auth.sh
@@ -4,9 +4,9 @@
 # differ only in where accounts live. The unit checks meet luaossl and
 # luaposix with deterministic stand-ins from the harness, proving tampered
 # and expired cookies turned away, header injection stripped, unsafe
-# redirects refused and the login flows answering as documented. The run
-# through cgit itself needs the real modules inside the binary's own Lua, so
-# it is probed for, and proves an unedited copy protects nothing.
+# redirects refused and the login flows answering as documented. Through cgit
+# itself an unedited copy protects nothing, with or without the modules, and
+# when the binary's own Lua lacks them a protected repository stays closed.
 
 test_description='Check the shipped auth extensions'
 CGIT_TEST_NO_CREATE_REPOS=YesPlease
@@ -41,11 +41,16 @@ if test "$CGIT_HAS_LUA" -eq 1 &&
 	cgit_lua_probe "$PWD/repos/authy/.git" openssl.rand openssl.hmac posix.sys.stat posix.unistd
 then
 	test_set_prereq CGIT_LUA_AUTH
+elif test "$CGIT_HAS_LUA" -eq 1
+then
+	test_set_prereq CGIT_LUA_NOAUTH
+	say 'cgit lua lacks luaossl or luaposix, expecting protected pages refused'
 else
-	say 'cgit lua lacks luaossl or luaposix, checks through cgit skipped'
+	say 'cgit built without lua, checks through cgit skipped'
 fi
+test "$CGIT_HAS_LUA" -eq 1 && test_set_prereq CGIT_LUA
 
-test_expect_success CGIT_LUA_AUTH 'point cgit at the unedited auth filter' '
+test_expect_success CGIT_LUA 'point cgit at the unedited auth filter' '
 	cat >cgitrc <<-EOF
 	virtual-root=/
 	cache-size=0
@@ -55,9 +60,28 @@ test_expect_success CGIT_LUA_AUTH 'point cgit at the unedited auth filter' '
 	EOF
 '
 
-test_expect_success CGIT_LUA_AUTH 'an unedited copy protects nothing' '
+test_expect_success CGIT_LUA 'an unedited copy protects nothing' '
 	cgit_url "authy/log/" >tmp &&
 	grep ">guarded commit</a>" tmp
 '
 
+test_expect_success CGIT_LUA_NOAUTH 'without the modules a protected repository stays closed' '
+	cat >protect.awk <<-\EOF &&
+	{ print }
+	/^local protected_repos = [{]$/ { print "\t[\"authy\"] = { alice = true }," }
+	EOF
+	awk -f protect.awk "$EXTENSIONS_DIRECTORY/auth-inline.lua" >guarded.lua &&
+	grep "\"authy\"" guarded.lua &&
+	cat >guardedrc <<-EOF &&
+	virtual-root=/
+	cache-size=0
+	auth-filter=lua:$PWD/guarded.lua
+	repo.url=authy
+	repo.path=$PWD/repos/authy/.git
+	EOF
+	CGIT_CONFIG="$PWD/guardedrc" QUERY_STRING="url=authy/log/" cgit >tmp &&
+	! grep "guarded commit" tmp &&
+	grep "Unable to complete the request" tmp
+'
+
 test_done