Diff options
Diffstat (limited to 'tests/extensions/test-auth.lua')
| -rw-r--r-- | tests/extensions/test-auth.lua | 34 |
1 file changed, 18 insertions, 16 deletions
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index c070ba9..97639ea 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -1,6 +1,7 @@ -- Unit checks for the two auth filters, run under a standalone Lua by --- t0505-auth.sh with the script path as the first argument and the variant, --- inline or file, as the second. The scripts take luaossl and luaposix at +-- t0505-auth.sh with the script path as the first argument, the variant, +-- inline or file, as the second and a directory of the run's own as the +-- third, which takes the fixtures. The scripts take luaossl and luaposix at -- load, so the harness meets both with deterministic stand-ins, which keeps -- every check about this script's own logic, the cookie layout, the expiry -- and field rules, the redirect vetting and the action flows, rather than @@ -16,6 +17,7 @@ local h = dofile(test_directory .. "/harness.lua") local script = arg[1] local variant = arg[2] +local directory = assert(arg[3], "test-auth.lua needs a directory for its fixtures") h.stub_auth_modules() @@ -25,23 +27,23 @@ local password = "open sesame" local stored_hash = "$6$rounds=300000$testsalt$" .. password if variant == "file" then - local users_file = io.open("auth-users", "w") + local users_file = io.open(directory .. "/auth-users", "w") users_file:write("Alice:" .. stored_hash .. "\r\n") users_file:write("not a parsable line\n") users_file:write("carol:" .. stored_hash .. "\n") users_file:close() - local groups_file = io.open("auth-groups", "w") + local groups_file = io.open(directory .. "/auth-groups", "w") groups_file:write("devs:Alice, bob\n") groups_file:write("others:carol\n") groups_file:close() - local repos_file = io.open("auth-repos", "w") + local repos_file = io.open(directory .. "/auth-repos", "w") repos_file:write("secret-repo:devs\n") repos_file:write("empty-repo:ghosts\n") repos_file:write("bare-repo:\n") repos_file:close() - h.redirect_file("/etc/cgit-auth/users", "auth-users") - h.redirect_file("/etc/cgit-auth/groups", "auth-groups") - h.redirect_file("/etc/cgit-auth/repos", "auth-repos") + h.redirect_file("/etc/cgit-auth/users", directory .. "/auth-users") + h.redirect_file("/etc/cgit-auth/groups", directory .. "/auth-groups") + h.redirect_file("/etc/cgit-auth/repos", directory .. "/auth-repos") end -- The inline script carries its lists in the code, so its commented-out @@ -108,19 +110,19 @@ h.check("a protected repository with no groups at all denies too", bare ~= nil and next(bare) == nil) if variant == "file" then - h.redirect_file("/etc/cgit-auth/users", "auth-users-missing") + h.redirect_file("/etc/cgit-auth/users", directory .. "/auth-users-missing") h.equals("a missing users file turns every login down", account_hash("alice"), nil) - h.redirect_file("/etc/cgit-auth/users", "auth-users") + h.redirect_file("/etc/cgit-auth/users", directory .. "/auth-users") -- Without the repos file nothing tells a protected repository from a -- public one, so every page is refused, the index too, which cgit asks -- about with an empty repository name. - h.redirect_file("/etc/cgit-auth/repos", "auth-repos-missing") + h.redirect_file("/etc/cgit-auth/repos", directory .. "/auth-repos-missing") local refused = repo_userset("unlisted") h.check("a missing repos file refuses every repository", refused ~= nil and next(refused) == nil) local index = repo_userset("") h.check("and the index as well", index ~= nil and next(index) == nil) - h.redirect_file("/etc/cgit-auth/repos", "auth-repos") + h.redirect_file("/etc/cgit-auth/repos", directory .. "/auth-repos") end -- The url and cookie helpers. @@ -322,13 +324,13 @@ h.equals("and leaves the flag out of the way back", way_back_in(out), "/repo/log -- The real get_secret, pointed at a directory nobody made, cannot sign the -- way back, so the page says so whole rather than breaking off in the form. h.load_with(script, { { "local secret_filename = \"/var/lib/cgit/auth-secret\"", - "local secret_filename = \"no-such-directory/auth-secret\"" } }) + "local secret_filename = " .. string.format("%q", directory .. "/no-such-directory/auth-secret") } }) out = run_action("body", {}) h.contains("a secret that cannot be made leaves a page saying so", out, "<p class='login-error' role='alert'>Logins are unavailable. The server's error log says why.</p>") h.excludes("with no form to fill in", out, "<form") h.contains("and the error log names the directory", h.error_log(), - "as no-such-directory is missing or not writable by cgit\n") + "as " .. directory .. "/no-such-directory is missing or not writable by cgit\n") load_script() local way_back = secure_value("redirect", "/repo/", 0) @@ -360,11 +362,11 @@ h.contains("and lands on the same flagged page", out, "Location: /repo/?login=fa h.equals("a missing account spends crypt on a configured hash", crypt_settings[1], stored_hash) if variant == "file" then - h.redirect_file("/etc/cgit-auth/users", "auth-users-missing") + h.redirect_file("/etc/cgit-auth/users", directory .. "/auth-users-missing") crypt_settings = {} login("nobody", "x", way_back) h.equals("with no accounts at all nothing is spent", #crypt_settings, 0) - h.redirect_file("/etc/cgit-auth/users", "auth-users") + h.redirect_file("/etc/cgit-auth/users", directory .. "/auth-users") end -- crypt's work grows with the password, so one past the cap is turned down |