Age	Commit message (Collapse)	Author	Lines
20 hours	Ask for the working auth pages through cgit_ok	Bryce Kwon	-13/+19
	The unedited copy and the login page were requested through cgit_rc, so a page cut short or an error logged on the way passed. The owner and description checks on the login page could not fail either if the config lost them, so the same config with a filter that lets the visitor in now has to show both.
20 hours	Count the auth unit checks as skipped without Lua	Bryce Kwon	-3/+6
	With no standalone Lua on the path the unit checks were never registered, so they counted as neither run nor skipped, and t0505 passed on its cgit checks alone.
20 hours	Write the auth test configs through cgitrc_repo	Bryce Kwon	-25/+4
20 hours	Check the two auth filters share their code	Bryce Kwon	-0/+14
	Both say a change to the code they share belongs in both, but nothing held them to it, so a fix made to one alone in a path the unit checks do not reach would have gone unseen.
21 hours	Check which library cgit logs as missing	Bryce Kwon	-2/+6
	The cgit-level check accepted any line starting "[cgit] ", the prefix of cgit's own messages too, as proof that the filter logged a missing module. The guarded copy also kept the system secret path, so on a host with luaossl and a readable secret but no luaposix the form would be signed and the test would fail.
21 hours	Run the auth checks against the real libraries	Bryce Kwon	-5/+89
	The unit checks always took the harness stand-ins and the cgit-level checks needed a module to be missing, so the real luaossl and luaposix were never exercised anywhere. A misuse of their interfaces, or a login through cgit that never worked, passed every run. Where an interpreter has both libraries and its crypt(3) checks a SHA-512 hash from openssl passwd, the unit checks run again against them, adding the secret's mode. Where cgit's own Lua does, a login is posted through cgit and the cookie it grants opens the repository. Both skip where crypt checks no SHA-512 hash or the libraries are missing.
21 hours	Check that an auth filter is handed the url	Bryce Kwon	-0/+35
	Both shipped filters key their access lists by a repository's url, and MANUAL says cgit hands that over, but nothing read the argument. Every auth test served a repository whose url and name were the same, so a cgit that passed repo.name, under which a url-keyed list matches nothing and every protected repository goes public, passed.
22 hours	Give each auth unit run a directory of its own	Bryce Kwon	-3/+5
	test-auth.lua wrote its fixtures into whatever directory it was started from, so a run by hand from the checkout left auth-users and its siblings behind, and the checks assumed no auth-users-missing or no-such-directory already sat there. It now refuses to run without a directory, and t0505 hands each interpreter and variant a fresh one. The interpreter and paths are expanded inside the test body rather than pasted into it in single quotes, so a path holding a quote no longer breaks the eval.
6 days	Say when logins are unavailable	Bryce Kwon	-2/+3
	The way back was signed part way through the form, so while the secret's directory did not exist, or a library was missing, cgit's error landed inside the hidden input and the page broke off there with no fields.
7 days	Keep the login page out of search indexes	Bryce Kwon	-0/+14
7 days	Keep a protected repository's header to itself	Bryce Kwon	-0/+28
	The login page stands in for any page of the repository, so it named the description and owner of one the visitor may not see, including one hidden from the index. The site's own description fills the line, as on the index, so the header keeps its height.
8 days	Move the later tests to the config writers	Bryce Kwon	-1/+1
	The one-line request wrappers go with them. Configs with several repositories, a key out of place on purpose, the cache on or no repository of their own stay written out.
9 days	Drop an auth prerequisite no test asks for	Bryce Kwon	-4/+2
9 days	Set the Lua prerequisite once for every test	Bryce Kwon	-9/+1
	setup.sh already asks the binary, so the seven scripts that each turned the answer into a prerequisite now share one. test-lib names the missing prerequisite beside every test it skips, so the notes that cgit lacks Lua go, while the ones announcing a fallback stay. Every script that listed the standalone interpreters asked for the same ceiling, so lib.sh now builds that list for all of them.
2026-10-07	Claim and test Lua 5.5 for every extension	Bryce Kwon	-1/+1
	luaossl from release 20260910 and luaposix load under Lua 5.5, and cgit renders the same pages under it as under LuaJIT. Running the suites there already caught a write to a for loop's control variable, which 5.5 makes read-only.
2026-10-04	Load auth libraries only when a request needs one	Bryce Kwon	-6/+30
	Required at the top, a missing luaossl or luaposix failed every request to the site, public pages included, and each public page paid to load both.
2026-09-07	Clean up the whole tree	Bryce Kwon	-4/+2
2026-09-06	Trim the comments and dead code across the tree	Bryce Kwon	-9/+6
2026-09-04	Add a test suite for the shipped extensions	Bryce Kwon	-0/+68