1 file changed, 16 insertions, 8 deletions
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index 86f8f89..1531040 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -39,11 +39,12 @@ if variant == "file" then
 	users_file:write("carol:" .. stored_hash .. "\n")
 	users_file:close()
 	local groups_file = io.open(directory .. "/auth-groups", "w")
-	groups_file:write("devs:Alice, bob\n")
-	groups_file:write("others:carol\n")
+	groups_file:write("DEVS:Alice, bob\n")
+	groups_file:write("others:carol, alice\n")
 	groups_file:close()
 	local repos_file = io.open(directory .. "/auth-repos", "w")
-	repos_file:write("secret-repo:devs\n")
+	repos_file:write("secret-repo:Devs\n")
+	repos_file:write("both-repo:devs,others\n")
 	repos_file:write("empty-repo:ghosts\n")
 	repos_file:write("bare-repo:\n")
 	repos_file:close()
@@ -57,8 +58,8 @@ end
 local inline_config = {
 	{ "local protected_repos = {\n", "local protected_repos = {\n" ..
 		"\t[\"secret-repo\"] = { alice = true, Bob = true },\n" ..
-		"\t[\"empty-repo\"] = {},\n" ..
-		"\t[\"bare-repo\"] = {},\n" },
+		"\t[\"both-repo\"] = { alice = true, bob = true, carol = true },\n" ..
+		"\t[\"empty-repo\"] = {},\n" },
 	{ "local users = {\n", "local users = {\n" ..
 		"\tAlice = \"" .. stored_hash .. "\",\n" ..
 		"\tcarol = \"" .. stored_hash .. "\",\n" },
@@ -190,9 +191,14 @@ h.equals("the repository name matches case exactly", repo_userset("Secret-Repo")
 local empty = repo_userset("empty-repo")
 h.check("a protected repository with no members denies as an empty set",
 	empty ~= nil and next(empty) == nil)
-local bare = repo_userset("bare-repo")
-h.check("a protected repository with no groups at all denies too",
-	bare ~= nil and next(bare) == nil)
+local both = repo_userset("both-repo")
+h.check("a repository of two groups lets in the members of each",
+	both ~= nil and both.alice and both.bob and both.carol)
+if variant == "file" then
+	local bare = repo_userset("bare-repo")
+	h.check("a protected repository with no groups at all denies too",
+		bare ~= nil and next(bare) == nil)
+end
 
 if variant == "file" then
 	h.redirect_file("/etc/cgit-auth/users", directory .. "/auth-users-missing")
@@ -414,6 +420,7 @@ h.equals("a session signed without its binding does not verify",
 	validate_value("username", unbound, account_hash), nil)
 
 h.equals("a memberless repository denies even a valid session", visit("empty-repo", session), 0)
+h.equals("a repository of two groups lets in a member of the first", visit("both-repo", session), 1)
 if variant == "file" then
 	h.redirect_file("/etc/cgit-auth/groups", directory .. "/auth-groups-missing")
 	h.equals("as does one whose groups file is missing", visit("secret-repo", session), 0)
@@ -422,6 +429,7 @@ end
 
 local outsider = secure_value("username", "carol", now + 3600, stored_hash)
 h.equals("a signed session for an outsider is turned away", visit("secret-repo", outsider), 0)
+h.equals("while one in the second group lets them in", visit("both-repo", outsider), 1)
 
 local forged = session:sub(1, -2) .. (session:sub(-1) == "0" and "1" or "0")
 h.equals("a forged session is turned away", visit("secret-repo", forged), 0)