1 file changed, 13 insertions, 0 deletions
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index e0d2fe5..eb402da 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -328,4 +328,17 @@ out, ret = run_action("authenticate-post", {
 })
 h.contains("even a signed unsafe destination is not followed", out, "Status: 404")
 
+-- The libraries load only once a request needs one, so with every one of
+-- them gone a public repository is still served, while a protected one
+-- fails closed instead of reaching its content.
+for _, name in ipairs({ "openssl.rand", "openssl.hmac", "posix.sys.stat", "posix.unistd" }) do
+	package.loaded[name] = nil
+	h.preload_failure(name)
+end
+out, ret = run_action("authenticate-cookie", { repo = "unlisted" })
+h.equals("without the libraries a public repository is served", ret, 1)
+h.check("while a protected one fails closed", not pcall(run_action,
+	"authenticate-cookie", { repo = "secret-repo", cookie = "cgitauth=" .. session }))
+h.check("and so does its login form", not pcall(run_action, "body", {}))
+
 h.finish()