From ddad4565da40b52af29a730528fca01537665221 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Mon, 2 Nov 2026 19:20:13 -1000
Subject: Tell a signed-in visitor they have no access

---
 tests/extensions/test-auth.lua | 7 +++++++
 1 file changed, 7 insertions(+)

(limited to 'tests/extensions/test-auth.lua')

diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index 3a4fabf..db97bb3 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -293,6 +293,13 @@ h.contains("the login form posts to the login url", out, "<form class='login' me
 h.equals("a first visit says nothing failed", out:find("login-error", 1, true), nil)
 h.equals("the form carries a signed way back", way_back_in(out), "/repo/log/?q=x")
 
+out = run_action("body", { cookie = session_name .. "=" .. outsider })
+h.contains("a visitor signed in without access is told so", out,
+	"<p class='login-error' role='alert'>You are signed in but have no access to this repository.</p>")
+h.check("and can still sign in as someone else", way_back_in(out) ~= nil)
+out = run_action("body", { cookie = session_name .. "=" .. forged })
+h.excludes("a forged session is not taken for a signed-in visitor", out, "signed in")
+
 out = run_action("body", { url = "//evil.example/x" })
 h.equals("an unsafe destination is swapped for the login page", way_back_in(out), "/?p=login")
 h.equals("and is not taken for a failed login", out:find("login-error", 1, true), nil)
-- 
cgit 2.12.1