From 1a64fc8f86d9fec6fb3a2322e1876537e32fa52c Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 13:55:09 -1000 Subject: Give each auth unit run a directory of its own test-auth.lua wrote its fixtures into whatever directory it was started from, so a run by hand from the checkout left auth-users and its siblings behind, and the checks assumed no auth-users-missing or no-such-directory already sat there. It now refuses to run without a directory, and t0505 hands each interpreter and variant a fresh one. The interpreter and paths are expanded inside the test body rather than pasted into it in single quotes, so a path holding a quote no longer breaks the eval. --- tests/extensions/test-auth.lua | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) (limited to 'tests/extensions') diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index c070ba9..97639ea 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -1,6 +1,7 @@ -- Unit checks for the two auth filters, run under a standalone Lua by --- t0505-auth.sh with the script path as the first argument and the variant, --- inline or file, as the second. The scripts take luaossl and luaposix at +-- t0505-auth.sh with the script path as the first argument, the variant, +-- inline or file, as the second and a directory of the run's own as the +-- third, which takes the fixtures. The scripts take luaossl and luaposix at -- load, so the harness meets both with deterministic stand-ins, which keeps -- every check about this script's own logic, the cookie layout, the expiry -- and field rules, the redirect vetting and the action flows, rather than @@ -16,6 +17,7 @@ local h = dofile(test_directory .. "/harness.lua") local script = arg[1] local variant = arg[2] +local directory = assert(arg[3], "test-auth.lua needs a directory for its fixtures") h.stub_auth_modules() @@ -25,23 +27,23 @@ local password = "open sesame" local stored_hash = "$6$rounds=300000$testsalt$" .. password if variant == "file" then - local users_file = io.open("auth-users", "w") + local users_file = io.open(directory .. "/auth-users", "w") users_file:write("Alice:" .. stored_hash .. "\r\n") users_file:write("not a parsable line\n") users_file:write("carol:" .. stored_hash .. "\n") users_file:close() - local groups_file = io.open("auth-groups", "w") + local groups_file = io.open(directory .. "/auth-groups", "w") groups_file:write("devs:Alice, bob\n") groups_file:write("others:carol\n") groups_file:close() - local repos_file = io.open("auth-repos", "w") + local repos_file = io.open(directory .. "/auth-repos", "w") repos_file:write("secret-repo:devs\n") repos_file:write("empty-repo:ghosts\n") repos_file:write("bare-repo:\n") repos_file:close() - h.redirect_file("/etc/cgit-auth/users", "auth-users") - h.redirect_file("/etc/cgit-auth/groups", "auth-groups") - h.redirect_file("/etc/cgit-auth/repos", "auth-repos") + h.redirect_file("/etc/cgit-auth/users", directory .. "/auth-users") + h.redirect_file("/etc/cgit-auth/groups", directory .. "/auth-groups") + h.redirect_file("/etc/cgit-auth/repos", directory .. "/auth-repos") end -- The inline script carries its lists in the code, so its commented-out @@ -108,19 +110,19 @@ h.check("a protected repository with no groups at all denies too", bare ~= nil and next(bare) == nil) if variant == "file" then - h.redirect_file("/etc/cgit-auth/users", "auth-users-missing") + h.redirect_file("/etc/cgit-auth/users", directory .. "/auth-users-missing") h.equals("a missing users file turns every login down", account_hash("alice"), nil) - h.redirect_file("/etc/cgit-auth/users", "auth-users") + h.redirect_file("/etc/cgit-auth/users", directory .. "/auth-users") -- Without the repos file nothing tells a protected repository from a -- public one, so every page is refused, the index too, which cgit asks -- about with an empty repository name. - h.redirect_file("/etc/cgit-auth/repos", "auth-repos-missing") + h.redirect_file("/etc/cgit-auth/repos", directory .. "/auth-repos-missing") local refused = repo_userset("unlisted") h.check("a missing repos file refuses every repository", refused ~= nil and next(refused) == nil) local index = repo_userset("") h.check("and the index as well", index ~= nil and next(index) == nil) - h.redirect_file("/etc/cgit-auth/repos", "auth-repos") + h.redirect_file("/etc/cgit-auth/repos", directory .. "/auth-repos") end -- The url and cookie helpers. @@ -322,13 +324,13 @@ h.equals("and leaves the flag out of the way back", way_back_in(out), "/repo/log -- The real get_secret, pointed at a directory nobody made, cannot sign the -- way back, so the page says so whole rather than breaking off in the form. h.load_with(script, { { "local secret_filename = \"/var/lib/cgit/auth-secret\"", - "local secret_filename = \"no-such-directory/auth-secret\"" } }) + "local secret_filename = " .. string.format("%q", directory .. "/no-such-directory/auth-secret") } }) out = run_action("body", {}) h.contains("a secret that cannot be made leaves a page saying so", out, "") h.excludes("with no form to fill in", out, "