1 file changed, 13 insertions, 0 deletions
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index e9fed78..0025a81 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -36,6 +36,7 @@ if variant == "file" then
 	local repos_file = io.open("auth-repos", "w")
 	repos_file:write("secret-repo:devs\n")
 	repos_file:write("empty-repo:ghosts\n")
+	repos_file:write("bare-repo:\n")
 	repos_file:close()
 	h.redirect_file("/etc/cgit-auth/users", "auth-users")
 	h.redirect_file("/etc/cgit-auth/groups", "auth-groups")
@@ -53,6 +54,7 @@ if variant == "inline" then
 	local access = {
 		["secret-repo"] = { alice = true, bob = true },
 		["empty-repo"] = {},
+		["bare-repo"] = {},
 	}
 	function account_hash(user)
 		if user == nil then
@@ -83,11 +85,22 @@ h.equals("the repository name matches case exactly", repo_userset("Secret-Repo")
 local empty = repo_userset("empty-repo")
 h.check("a protected repository with no members denies as an empty set",
 	empty ~= nil and next(empty) == nil)
+local bare = repo_userset("bare-repo")
+h.check("a protected repository with no groups at all denies too",
+	bare ~= nil and next(bare) == nil)
 
 if variant == "file" then
 	h.redirect_file("/etc/cgit-auth/users", "auth-users-missing")
 	h.equals("a missing users file turns every login down", account_hash("alice"), nil)
 	h.redirect_file("/etc/cgit-auth/users", "auth-users")
+	-- Without the repos file nothing tells a protected repository from a
+	-- public one, so every repository is refused while the index stays up.
+	h.redirect_file("/etc/cgit-auth/repos", "auth-repos-missing")
+	local refused = repo_userset("unlisted")
+	h.check("a missing repos file refuses every repository",
+		refused ~= nil and next(refused) == nil)
+	h.equals("the index stays public all the same", repo_userset(nil), nil)
+	h.redirect_file("/etc/cgit-auth/repos", "auth-repos")
 end
 
 -- The url and cookie helpers.