#!/bin/sh
# Checks auth-file.lua and auth-inline.lua, the shipped auth filters, which
# differ only in where accounts live. The unit checks meet luaossl and
# luaposix with deterministic stand-ins from the harness, and once more the
# real libraries wherever they are installed, proving tampered and expired
# cookies turned away, header injection stripped, unsafe redirects refused
# and the login flows answering as documented. Through cgit itself an
# unedited copy protects nothing, with or without the modules. When the
# binary's own Lua lacks them a protected repository stays closed, and when
# it has them a login opens one. A unit run is one test of some two hundred
# checks, and the names of those that failed show only under -v.
test_description='Check the shipped auth extensions'
CGIT_TEST_NO_CREATE_REPOS=YesPlease
. ./setup.sh
. "$TEST_OUTPUT_DIRECTORY/extensions/lib.sh"
# The unit checks run once more against the real luaossl and luaposix
# wherever an interpreter has them and its crypt(3) checks a SHA-512 hash.
auth_hash=$(openssl passwd -6 -salt testsalt "open sesame" 2>/dev/null) ||
auth_hash=
# With no standalone Lua the unit checks still count, as skipped.
test -z "$interpreters" || test_set_prereq STANDALONE_LUA
for lua in ${interpreters:-lua}
do
for variant in inline file
do
test_expect_success STANDALONE_LUA "auth-$variant checks under $lua" '
mkdir "unit-$lua-$variant" &&
"$lua" "$EXT_TEST_DIRECTORY/test-auth.lua" \
"$EXTENSIONS_DIRECTORY/auth-$variant.lua" $variant "$PWD/unit-$lua-$variant"
'
done
auth_libs=AUTH_LIBS_$(echo "$lua" | tr a-z. A-Z_)
if test -n "$auth_hash" &&
"$lua" -e "
require('openssl.hmac') require('openssl.rand') require('posix.sys.stat')
assert(require('posix.unistd').crypt('open sesame', '$auth_hash') == '$auth_hash')
" >/dev/null 2>&1
then
test_set_prereq $auth_libs
fi
for variant in inline file
do
test_expect_success "STANDALONE_LUA,$auth_libs" "auth-$variant checks against the real libraries under $lua" '
mkdir "real-$lua-$variant" &&
"$lua" "$EXT_TEST_DIRECTORY/test-auth.lua" \
"$EXTENSIONS_DIRECTORY/auth-$variant.lua" $variant "$PWD/real-$lua-$variant" "$auth_hash"
'
done
done
# Both filters say a change to the code they share belongs in both, and the
# only difference allowed is where each defines trim.
test_expect_success 'the two auth filters share their code word for word' '
sed -n "/^-- The url helpers below/,\$p" "$EXTENSIONS_DIRECTORY/auth-file.lua" >file-tail &&
sed -n "/^-- The url helpers below/,\$p" "$EXTENSIONS_DIRECTORY/auth-inline.lua" >inline-whole &&
sed "/^-- Lua patterns backtrack/,/^\$/d" inline-whole >inline-tail &&
test_line_count -gt 300 file-tail &&
test_cmp file-tail inline-tail &&
sed -n "/^-- Lua patterns backtrack/,/^end\$/p" "$EXTENSIONS_DIRECTORY/auth-file.lua" >file-trim &&
sed -n "/^-- Lua patterns backtrack/,/^end\$/p" "$EXTENSIONS_DIRECTORY/auth-inline.lua" >inline-trim &&
test_line_count = 14 file-trim &&
test_cmp file-trim inline-trim
'
test_expect_success 'create a repository with one commit' '
test_create_repo repos/authy &&
(
cd repos/authy &&
echo content >file &&
git add file &&
git commit -m "guarded commit"
)
'
if test "$CGIT_HAS_LUA" -eq 1 &&
! cgit_lua_probe "$PWD/repos/authy/.git" openssl.rand openssl.hmac posix.sys.stat posix.unistd
then
test_set_prereq CGIT_LUA_NOAUTH
say 'cgit lua lacks luaossl or luaposix, expecting protected pages refused'
elif test "$CGIT_HAS_LUA" -eq 1 && test -n "$auth_hash"
then
# A login through cgit also needs the crypt(3) behind cgit's own Lua to
# check the hash.
cat >crypt-probe.lua <<-EOF
function filter_open(...) end
function filter_write(str) end
function filter_close()
if require("posix.unistd").crypt("open sesame", "$auth_hash") == "$auth_hash" then
html("CRYPT_PROBE_YES")
end
return 0
end
EOF
cgitrc_repo crypt-probe-rc authy "repo.commit-filter=lua:$PWD/crypt-probe.lua"
if cgit_rc crypt-probe-rc "url=authy/commit/" | grep CRYPT_PROBE_YES >/dev/null
then
test_set_prereq CGIT_LUA_AUTH
fi
fi
test_expect_success CGIT_LUA 'point cgit at the unedited auth filter' '
cgitrc_repo cgitrc authy "auth-filter=lua:$EXTENSIONS_DIRECTORY/auth-inline.lua"
'
test_expect_success CGIT_LUA 'an unedited copy protects nothing' '
cgit_ok cgitrc "url=authy/log/" >tmp &&
test_grep ">guarded commit" tmp
'
# The secret has to be one not made yet, or a host secret already readable
# would sign the form wherever luaposix alone is missing.
test_expect_success CGIT_LUA_NOAUTH 'without the modules a protected repository stays closed' '
cat >protect.awk <<-\EOF &&
/^local secret_filename = / { print "local secret_filename = \"" secret "\""; next }
{ print }
/^local protected_repos = [{]$/ { print "\t[\"authy\"] = { alice = true }," }
EOF
awk -v secret="$PWD/guarded-secret" -f protect.awk "$EXTENSIONS_DIRECTORY/auth-inline.lua" >guarded.lua &&
grep "\"authy\"" guarded.lua &&
grep "guarded-secret" guarded.lua &&
cgitrc_repo guardedrc authy "auth-filter=lua:$PWD/guarded.lua" &&
cgit_rc guardedrc "url=authy/log/" >tmp 2>err &&
! grep "guarded commit" tmp &&
grep "Logins are unavailable" tmp &&
grep -E "^\[cgit\] .*module .(openssl\.rand|openssl\.hmac|posix\.sys\.stat|posix\.unistd). not found" err
'
# A login through cgit itself, from the form to the protected repository's
# pages, opened with the cookie it grants and closed again without it.
test_expect_success CGIT_LUA_AUTH 'a login through cgit opens a protected repository' '
cat >grant.awk <<-EOF &&
/^local secret_filename = / { print "local secret_filename = \"$PWD/login-secret\""; next }
{ print }
/^local protected_repos = [{]\$/ { print "\t[\"authy\"] = { alice = true }," }
/^local users = [{]\$/ { print "\talice = \"$auth_hash\"," }
EOF
awk -f grant.awk "$EXTENSIONS_DIRECTORY/auth-inline.lua" >granted.lua &&
grep "login-secret" granted.lua &&
grep "testsalt" granted.lua &&
grep "\"authy\"" granted.lua &&
cgitrc_repo grantrc authy "auth-filter=lua:$PWD/granted.lua" &&
(export HTTPS=on && cgit_ok grantrc "url=authy/log/") >form &&
grep "