Add a test suite for the shipped extensions

1 file changed, 68 insertions, 0 deletions

diff --git a/tests/t0505-auth.sh b/tests/t0505-auth.shnew file mode 100755index 0000000..d4dcd52--- /dev/null+++ b/tests/t0505-auth.sh@@ -0,0 +1,68 @@+#!/bin/sh++# Checks auth-file.lua and auth-inline.lua, the shipped auth filters, which+# share their cookie signing, redirect vetting and action flows and differ+# only in where accounts live. The unit checks under a standalone Lua meet+# luaossl and luaposix with deterministic stand-ins from the harness, so+# they prove this script's own logic on any machine, tampered and expired+# cookies turned away, header injection stripped, unsafe redirects refused+# and the login flows answering as documented. The run through cgit itself+# needs the real modules inside the binary's own Lua, so it is probed for,+# and an unedited copy protects nothing, which is itself the behaviour worth+# proving end to end.++test_description='Check the shipped auth extensions'+CGIT_TEST_NO_CREATE_REPOS=YesPlease+. ./setup.sh+. "$TEST_OUTPUT_DIRECTORY/extensions/lib.sh"++interpreters=$(ext_lua_interpreters 4)+test -z "$interpreters" &&+	say 'no standalone lua on the path, unit checks skipped'++for lua in $interpreters+do+	for variant in inline file+	do+		test_expect_success "auth-$variant checks under $lua" "+			'$lua' '$EXT_TEST_DIRECTORY/test-auth.lua' \+				'$EXTENSIONS_DIRECTORY/auth-$variant.lua' $variant+		"+	done+done++test_expect_success 'create a repository with one commit' '+	test_create_repo repos/authy &&+	(+		cd repos/authy &&+		echo content >file &&+		git add file &&+		git commit -m "guarded commit"+	)+'++if test "$CGIT_HAS_LUA" -eq 1 &&+	cgit_lua_probe "$PWD/repos/authy/.git" \+		openssl.rand openssl.hmac posix.sys.stat posix.unistd+then+	test_set_prereq CGIT_LUA_AUTH+else+	say 'cgit lua lacks luaossl or luaposix, checks through cgit skipped'+fi++test_expect_success CGIT_LUA_AUTH 'point cgit at the unedited auth filter' '+	cat >cgitrc <<-EOF+	virtual-root=/+	cache-size=0+	auth-filter=lua:$EXTENSIONS_DIRECTORY/auth-inline.lua+	repo.url=authy+	repo.path=$PWD/repos/authy/.git+	EOF+'++test_expect_success CGIT_LUA_AUTH 'an unedited copy protects nothing' '+	cgit_url "authy/log/" >tmp &&+	grep ">guarded commit</a>" tmp+'++test_done
diff --git a/tests/t0505-auth.sh b/tests/t0505-auth.sh
new file mode 100755
index 0000000..d4dcd52
--- /dev/null
+++ b/tests/t0505-auth.sh
@@ -0,0 +1,68 @@
+#!/bin/sh
+
+# Checks auth-file.lua and auth-inline.lua, the shipped auth filters, which
+# share their cookie signing, redirect vetting and action flows and differ
+# only in where accounts live. The unit checks under a standalone Lua meet
+# luaossl and luaposix with deterministic stand-ins from the harness, so
+# they prove this script's own logic on any machine, tampered and expired
+# cookies turned away, header injection stripped, unsafe redirects refused
+# and the login flows answering as documented. The run through cgit itself
+# needs the real modules inside the binary's own Lua, so it is probed for,
+# and an unedited copy protects nothing, which is itself the behaviour worth
+# proving end to end.
+
+test_description='Check the shipped auth extensions'
+CGIT_TEST_NO_CREATE_REPOS=YesPlease
+. ./setup.sh
+. "$TEST_OUTPUT_DIRECTORY/extensions/lib.sh"
+
+interpreters=$(ext_lua_interpreters 4)
+test -z "$interpreters" &&
+	say 'no standalone lua on the path, unit checks skipped'
+
+for lua in $interpreters
+do
+	for variant in inline file
+	do
+		test_expect_success "auth-$variant checks under $lua" "
+			'$lua' '$EXT_TEST_DIRECTORY/test-auth.lua' \
+				'$EXTENSIONS_DIRECTORY/auth-$variant.lua' $variant
+		"
+	done
+done
+
+test_expect_success 'create a repository with one commit' '
+	test_create_repo repos/authy &&
+	(
+		cd repos/authy &&
+		echo content >file &&
+		git add file &&
+		git commit -m "guarded commit"
+	)
+'
+
+if test "$CGIT_HAS_LUA" -eq 1 &&
+	cgit_lua_probe "$PWD/repos/authy/.git" \
+		openssl.rand openssl.hmac posix.sys.stat posix.unistd
+then
+	test_set_prereq CGIT_LUA_AUTH
+else
+	say 'cgit lua lacks luaossl or luaposix, checks through cgit skipped'
+fi
+
+test_expect_success CGIT_LUA_AUTH 'point cgit at the unedited auth filter' '
+	cat >cgitrc <<-EOF
+	virtual-root=/
+	cache-size=0
+	auth-filter=lua:$EXTENSIONS_DIRECTORY/auth-inline.lua
+	repo.url=authy
+	repo.path=$PWD/repos/authy/.git
+	EOF
+'
+
+test_expect_success CGIT_LUA_AUTH 'an unedited copy protects nothing' '
+	cgit_url "authy/log/" >tmp &&
+	grep ">guarded commit</a>" tmp
+'
+
+test_done