From f71b10409c0cd8e5afff00b6b5ca8521ae81c88f Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sat, 7 Nov 2026 14:10:58 -1000
Subject: Check the login form's field names

login() in the checks posts username and password under names of its
own, so renaming either field in the form broke every real login while
the suite passed.
---
 tests/extensions/test-auth.lua | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'tests/extensions/test-auth.lua')

diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index 852a5d9..8306aaf 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -428,6 +428,10 @@ h.equals("an unknown action denies rather than raising", ret, 0)
 out = run_action("body", { url = "/repo/log/?q=x" })
 h.contains("the login form posts to the login url", out, "<form class='login' method='post' action='/?p=login'>")
 h.contains("and its table is read as layout, not data", out, "<table role='presentation'>")
+-- login() posts the fields under names of its own, so nothing else holds
+-- the form to the names a login reads.
+h.contains("the form names its fields as a login reads them", out, "<input id='username' name='username'")
+h.contains("the password among them", out, "<input id='password' name='password'")
 h.equals("a first visit says nothing failed", out:find("login-error", 1, true), nil)
 h.equals("the form carries a signed way back", way_back_in(out), "/repo/log/?q=x")
 
-- 
cgit 2.12.1