From ddad4565da40b52af29a730528fca01537665221 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Mon, 2 Nov 2026 19:20:13 -1000
Subject: Tell a signed-in visitor they have no access

---
 custom/extensions/auth-file.lua   | 6 ++++++
 custom/extensions/auth-inline.lua | 6 ++++++
 tests/extensions/test-auth.lua    | 7 +++++++
 3 files changed, 19 insertions(+)

diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index 3814a1f..f05a59e 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -533,6 +533,12 @@ function body()
 		html("<p class='login-error' role='alert'>Logins are unavailable. The server's error log says why.</p>")
 		return 0
 	end
+	-- cgit asks for the form only once the cookie has been turned down, so
+	-- a session that still verifies belongs to someone not let in here.
+	local cookie = get_cookie(http["cookie"], session_cookie)
+	if validate_value("username", cookie, account_hash) then
+		html("<p class='login-error' role='alert'>You are signed in but have no access to this repository.</p>")
+	end
 	if failed then
 		html("<p class='login-error' role='alert'>Wrong username or password.</p>")
 	end
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua
index e7f12cd..878d55e 100644
--- a/custom/extensions/auth-inline.lua
+++ b/custom/extensions/auth-inline.lua
@@ -496,6 +496,12 @@ function body()
 		html("<p class='login-error' role='alert'>Logins are unavailable. The server's error log says why.</p>")
 		return 0
 	end
+	-- cgit asks for the form only once the cookie has been turned down, so
+	-- a session that still verifies belongs to someone not let in here.
+	local cookie = get_cookie(http["cookie"], session_cookie)
+	if validate_value("username", cookie, account_hash) then
+		html("<p class='login-error' role='alert'>You are signed in but have no access to this repository.</p>")
+	end
 	if failed then
 		html("<p class='login-error' role='alert'>Wrong username or password.</p>")
 	end
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index 3a4fabf..db97bb3 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -293,6 +293,13 @@ h.contains("the login form posts to the login url", out, "<form class='login' me
 h.equals("a first visit says nothing failed", out:find("login-error", 1, true), nil)
 h.equals("the form carries a signed way back", way_back_in(out), "/repo/log/?q=x")
 
+out = run_action("body", { cookie = session_name .. "=" .. outsider })
+h.contains("a visitor signed in without access is told so", out,
+	"<p class='login-error' role='alert'>You are signed in but have no access to this repository.</p>")
+h.check("and can still sign in as someone else", way_back_in(out) ~= nil)
+out = run_action("body", { cookie = session_name .. "=" .. forged })
+h.excludes("a forged session is not taken for a signed-in visitor", out, "signed in")
+
 out = run_action("body", { url = "//evil.example/x" })
 h.equals("an unsafe destination is swapped for the login page", way_back_in(out), "/?p=login")
 h.equals("and is not taken for a failed login", out:find("login-error", 1, true), nil)
-- 
cgit 2.12.1