From 121f9e9e9d524975f9eaa9352bcb0bf0434107d7 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sat, 7 Nov 2026 14:26:47 -1000
Subject: Check each auth library missing on its own

Only all four libraries missing at once was tried, and the script was
not reloaded after they went, so a require at load would not have
failed there. The protected visit passed on any error, a typo's nil
call included. A login never ran without a library, so a fallback that
skipped the mask, or one that let any password through when crypt was
missing, passed.
---
 tests/extensions/test-auth.lua | 49 +++++++++++++++++++++++++++++++++++++-----
 1 file changed, 44 insertions(+), 5 deletions(-)

diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index bd1f01c..dd719d9 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -618,15 +618,54 @@ h.check("and expires as long after the login",
 h.contains("and its cookie lasts as many whole seconds", out, "; Max-Age=129600\n")
 load_script()
 
--- The libraries load only once a request needs one, so with every one of
--- them gone a public repository is still served, while a protected one
--- fails closed instead of reaching its content.
-for _, name in ipairs({ "openssl.rand", "openssl.hmac", "posix.sys.stat", "posix.unistd" }) do
+local libraries = { "openssl.rand", "openssl.hmac", "posix.sys.stat", "posix.unistd" }
+
+local function without(name)
 	package.loaded[name] = nil
 	h.preload_failure(name)
 end
+
+-- Before the secret is made a login needs every library, so with any one of
+-- them gone the form gives way to a page saying logins are unavailable,
+-- while a session or a posted login fails closed, and each says which.
+for _, name in ipairs(libraries) do
+	local loaded, loader = package.loaded[name], package.preload[name]
+	without(name)
+	load_script(nil, directory .. "/unmade-secret")
+	out = run_action("body", {})
+	h.contains("without " .. name .. " the login page says logins are unavailable", out,
+		"Logins are unavailable.")
+	h.excludes("without " .. name .. " it has no form", out, "<form")
+	h.contains("without " .. name .. " the error log names it", h.error_log(), name)
+	local visited, visit_err = pcall(visit, "secret-repo", session)
+	h.check("without " .. name .. " a session fails closed", not visited)
+	h.contains("without " .. name .. " its error names it", tostring(visit_err), name)
+	local posted, post_err = pcall(login, "Alice", password, way_back)
+	h.check("without " .. name .. " a login fails closed", not posted)
+	h.contains("without " .. name .. " the login's error names it", tostring(post_err), name)
+	package.loaded[name], package.preload[name] = loaded, loader
+end
+
+-- Once the secret exists a login still needs crypt.
+load_script()
+local loaded, loader = package.loaded["posix.unistd"], package.preload["posix.unistd"]
+without("posix.unistd")
+local posted, post_err = pcall(login, "Alice", password, way_back)
+h.check("without posix.unistd a login with a made secret fails closed", not posted)
+h.contains("naming posix.unistd", tostring(post_err), "posix.unistd")
+package.loaded["posix.unistd"], package.preload["posix.unistd"] = loaded, loader
+
+-- The libraries load only once a request needs one, so with every one of
+-- them gone the script still loads and a public repository is served,
+-- while a protected one fails closed instead of reaching its content.
+for _, name in ipairs(libraries) do
+	without(name)
+end
+load_script()
 h.equals("without the libraries a public repository is served", visit("unlisted"), 1)
-h.check("while a protected one fails closed", not pcall(visit, "secret-repo", session))
+local visited, visit_err = pcall(visit, "secret-repo", session)
+h.check("while a protected one fails closed", not visited)
+h.contains("with an error naming the library it needed", tostring(visit_err), "openssl.hmac")
 out = run_action("body", {})
 h.contains("and its login page says logins are unavailable", out, "Logins are unavailable.")
 h.excludes("and no form to fill in", out, "<form")
-- 
cgit 2.12.1