From 283eb1a00504872188ce01ee5ee0d038550e9327 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sat, 7 Nov 2026 15:00:46 -1000
Subject: Check the form is there where a message is not

The checks that a forged session is not taken for a signed-in visitor,
and that https brings no warning, would also have passed on the page
saying logins are unavailable.
---
 tests/extensions/test-auth.lua | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index ac849c6..e52b406 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -478,6 +478,7 @@ h.contains("a visitor signed in without access is told so", out,
 	"<p class='login-error' role='alert'>You are signed in but have no access to this repository.</p>")
 h.check("and can still sign in as someone else", way_back_in(out) ~= nil)
 out = run_action("body", { cookie = session_name .. "=" .. forged })
+h.contains("a visitor with a forged session is still shown the form", out, "<form class='login'")
 h.excludes("a forged session is not taken for a signed-in visitor", out, "signed in")
 
 -- The session cookie is Secure, so a form served over plain http would only
@@ -487,6 +488,7 @@ h.contains("over plain http the form says logging in needs https", out,
 	"<p class='login-error' role='alert'>Logging in only works over https.</p>")
 h.check("and is still there to fill in", way_back_in(out) ~= nil)
 out = run_action("body", {})
+h.contains("over https the form is shown", out, "<form class='login'")
 h.excludes("over https it says nothing of the kind", out, "only works over https")
 
 out = run_action("body", { url = "//evil.example/x" })
@@ -645,7 +647,8 @@ out = login("Alice", password, way_back)
 h.contains("an insecure session cookie keeps its plain name", out, "Set-Cookie: cgitauth=")
 h.excludes("and is not marked Secure", out, "; Secure")
 out = run_action("body", { https = "" })
-h.excludes("so its form does not ask for https", out, "only works over https")
+h.contains("so its form is shown over plain http", out, "<form class='login'")
+h.excludes("without asking for https", out, "only works over https")
 load_script()
 
 -- A cookie carries whole seconds, while on Lua 5.3 and later a session length
-- 
cgit 2.12.1