2 files changed, 27 insertions, 11 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index 3d426e9..aef7190 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -64,7 +64,8 @@ local groups_filename = "/etc/cgit-auth/groups"
 -- Per-repository access lives one per line as reponame:group1,group2 and so
 -- on. A repository named here is protected and one that is not named is
 -- public. The repository name has to match exactly, while group and user names
--- match regardless of case.
+-- match regardless of case. While this file cannot be read every repository
+-- is refused, since nothing then tells the protected ones apart.
 local repos_filename = "/etc/cgit-auth/repos"
 
 -- Where the cookie-signing secret is stored, created on first use. It must be
@@ -142,18 +143,20 @@ function repo_userset(repo)
 		return nil
 	end
 	local groups = nil
-	local repos_file = io.open(repos_filename, "r")
-	if repos_file ~= nil then
-		for line in repos_file:lines() do
-			local name, list = string.match(line, "(.-):(.+)")
-			if name ~= nil and trim(name) == repo then
-				groups = {}
-				add_names(list, groups)
-				break
-			end
+	local repos_file, err = io.open(repos_filename, "r")
+	if repos_file == nil then
+		io.stderr:write("[cgit] Unable to read the auth repos file: " .. err .. "\n")
+		return {}
+	end
+	for line in repos_file:lines() do
+		local name, list = string.match(line, "(.-):(.*)")
+		if name ~= nil and trim(name) == repo then
+			groups = {}
+			add_names(list, groups)
+			break
 		end
-		repos_file:close()
 	end
+	repos_file:close()
 	if groups == nil then
 		return nil
 	end
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index e9fed78..0025a81 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -36,6 +36,7 @@ if variant == "file" then
 	local repos_file = io.open("auth-repos", "w")
 	repos_file:write("secret-repo:devs\n")
 	repos_file:write("empty-repo:ghosts\n")
+	repos_file:write("bare-repo:\n")
 	repos_file:close()
 	h.redirect_file("/etc/cgit-auth/users", "auth-users")
 	h.redirect_file("/etc/cgit-auth/groups", "auth-groups")
@@ -53,6 +54,7 @@ if variant == "inline" then
 	local access = {
 		["secret-repo"] = { alice = true, bob = true },
 		["empty-repo"] = {},
+		["bare-repo"] = {},
 	}
 	function account_hash(user)
 		if user == nil then
@@ -83,11 +85,22 @@ h.equals("the repository name matches case exactly", repo_userset("Secret-Repo")
 local empty = repo_userset("empty-repo")
 h.check("a protected repository with no members denies as an empty set",
 	empty ~= nil and next(empty) == nil)
+local bare = repo_userset("bare-repo")
+h.check("a protected repository with no groups at all denies too",
+	bare ~= nil and next(bare) == nil)
 
 if variant == "file" then
 	h.redirect_file("/etc/cgit-auth/users", "auth-users-missing")
 	h.equals("a missing users file turns every login down", account_hash("alice"), nil)
 	h.redirect_file("/etc/cgit-auth/users", "auth-users")
+	-- Without the repos file nothing tells a protected repository from a
+	-- public one, so every repository is refused while the index stays up.
+	h.redirect_file("/etc/cgit-auth/repos", "auth-repos-missing")
+	local refused = repo_userset("unlisted")
+	h.check("a missing repos file refuses every repository",
+		refused ~= nil and next(refused) == nil)
+	h.equals("the index stays public all the same", repo_userset(nil), nil)
+	h.redirect_file("/etc/cgit-auth/repos", "auth-repos")
 end
 
 -- The url and cookie helpers.