From ddad4565da40b52af29a730528fca01537665221 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Mon, 2 Nov 2026 19:20:13 -1000
Subject: Tell a signed-in visitor they have no access

---
 custom/extensions/auth-file.lua | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'custom/extensions/auth-file.lua')

diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index 3814a1f..f05a59e 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -533,6 +533,12 @@ function body()
 		html("<p class='login-error' role='alert'>Logins are unavailable. The server's error log says why.</p>")
 		return 0
 	end
+	-- cgit asks for the form only once the cookie has been turned down, so
+	-- a session that still verifies belongs to someone not let in here.
+	local cookie = get_cookie(http["cookie"], session_cookie)
+	if validate_value("username", cookie, account_hash) then
+		html("<p class='login-error' role='alert'>You are signed in but have no access to this repository.</p>")
+	end
 	if failed then
 		html("<p class='login-error' role='alert'>Wrong username or password.</p>")
 	end
-- 
cgit 2.12.1