2 files changed, 17 insertions, 9 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index 8a3a771..ba05875 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -80,11 +80,15 @@ local users_filename = "/etc/cgit-auth/users"
 -- on.
 local groups_filename = "/etc/cgit-auth/groups"
 
--- Per-repository access lives one per line as reponame:group1,group2 and so
--- on. A repository named here is protected and one that is not named is
--- public. The repository name has to match exactly, while group and user names
--- match regardless of case. While this file cannot be read every page, the
--- index too, is refused, since nothing then tells the protected ones apart.
+-- Per-repository access lives one per line as url:group1,group2 and so on,
+-- keyed by the repository's url rather than the name the index shows, which
+-- repo.name or section-from-path can make differ. With section-from-path=1, a
+-- repository that scan-path finds at team/tools.git shows as tools.git but
+-- keeps team/tools.git as its url. A repository named here is protected and
+-- one that is not named is public. The url has to match exactly, while group
+-- and user names match regardless of case. While this file cannot be read
+-- every page, the index too, is refused, since nothing then tells the
+-- protected ones apart.
 local repos_filename = "/etc/cgit-auth/repos"
 
 -- Where the cookie-signing secret is stored, created on first use. It must be
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua
index 014caa9..971d662 100644
--- a/custom/extensions/auth-inline.lua
+++ b/custom/extensions/auth-inline.lua
@@ -62,9 +62,13 @@
 
 
 -- Protected repositories and the users allowed into each. A repository named
--- here is protected and one that is not named is public. The repository key
--- has to match exactly, while user names match regardless of case. The
--- examples are commented out, so an unedited copy protects nothing.
+-- here is protected and one that is not named is public. The key is the
+-- repository's url, not the name the index shows, which repo.name or
+-- section-from-path can make differ. With section-from-path=1, a repository
+-- that scan-path finds at team/tools.git shows as tools.git but keeps
+-- team/tools.git as its url. The url has to match exactly, while user names
+-- match regardless of case. The examples are commented out, so an unedited
+-- copy protects nothing.
 local protected_repos = {
 	-- ["secret-repo"] = { alice = true, bob = true },
 	-- ["another"]     = { alice = true },
@@ -134,7 +138,7 @@ local action, http, cgit, post
 
 -- The configured tables are folded to lowercased user names once, so that a
 -- lookup matches whatever case the login form was filled in with, the way
--- auth-file.lua does. Repository names keep their case.
+-- auth-file.lua does. Repository urls keep their case.
 do
 	local folded_users = {}
 	for name, hash in pairs(users) do
-rw-r--r--	custom/extensions/auth-file.lua	14
-rw-r--r--	custom/extensions/auth-inline.lua	12