1 file changed, 35 insertions, 0 deletions
diff --git a/tests/t0505-auth.sh b/tests/t0505-auth.sh
index 7562e49..35bd591 100755
--- a/tests/t0505-auth.sh
+++ b/tests/t0505-auth.sh
@@ -77,6 +77,41 @@ test_expect_success CGIT_LUA_NOAUTH 'without the modules a protected repository
 	grep "^\[cgit\] " err
 '
 
+# The access lists are keyed by a repository's url, which repo.name and
+# section-from-path can make differ from the name the index shows, so a
+# filter handed the name would leave a protected repository public.
+test_expect_success 'an auth filter is handed the repository url' '
+	write_script seen.sh <<-\EOF &&
+	test "$1" = authenticate-cookie && printf "%s\n" "$9" >seen
+	exit 1
+	EOF
+	cgitrc_repo seenrc team/tools.git "auth-filter=exec:$PWD/seen.sh" \
+		"repo.path=$PWD/repos/authy/.git" "repo.name=tools.git" &&
+	echo team/tools.git >expect &&
+	cgit_ok seenrc "url=team/tools.git/log/" >tmp &&
+	grep ">guarded commit</a>" tmp &&
+	test_cmp expect seen &&
+	rm seen &&
+	cgit_ok seenrc "r=team/tools.git&p=log" >tmp &&
+	grep ">guarded commit</a>" tmp &&
+	test_cmp expect seen &&
+	mkdir -p scan/team &&
+	git clone -q --bare repos/authy scan/team/tools.git &&
+	cat >scanrc <<-EOF &&
+	virtual-root=/
+	cache-size=0
+	auth-filter=exec:$PWD/seen.sh
+	section-from-path=1
+	scan-path=$PWD/scan
+	EOF
+	cgit_ok scanrc "" >tmp &&
+	grep ">tools.git</a>" tmp &&
+	rm seen &&
+	cgit_ok scanrc "url=team/tools.git/log/" >tmp &&
+	grep ">guarded commit</a>" tmp &&
+	test_cmp expect seen
+'
+
 # A filter of the test's own turns every visitor away, which needs no Lua.
 # Until a visitor is let in, the header of a protected repository shows the
 # site's description in place of its own and no owner, even for a