#!/bin/sh

# Checks auth-file.lua and auth-inline.lua, the shipped auth filters, which
# differ only in where accounts live. The unit checks meet luaossl and
# luaposix with deterministic stand-ins from the harness, proving tampered
# and expired cookies turned away, header injection stripped, unsafe
# redirects refused and the login flows answering as documented. Through cgit
# itself an unedited copy protects nothing, with or without the modules, and
# when the binary's own Lua lacks them a protected repository stays closed.

test_description='Check the shipped auth extensions'
CGIT_TEST_NO_CREATE_REPOS=YesPlease
. ./setup.sh
. "$TEST_OUTPUT_DIRECTORY/extensions/lib.sh"

interpreters=$(ext_lua_interpreters 4)
test -z "$interpreters" &&
	say 'no standalone lua on the path, unit checks skipped'

for lua in $interpreters
do
	for variant in inline file
	do
		test_expect_success "auth-$variant checks under $lua" "
			'$lua' '$EXT_TEST_DIRECTORY/test-auth.lua' '$EXTENSIONS_DIRECTORY/auth-$variant.lua' $variant
		"
	done
done

test_expect_success 'create a repository with one commit' '
	test_create_repo repos/authy &&
	(
		cd repos/authy &&
		echo content >file &&
		git add file &&
		git commit -m "guarded commit"
	)
'

if test "$CGIT_HAS_LUA" -eq 1 &&
	cgit_lua_probe "$PWD/repos/authy/.git" openssl.rand openssl.hmac posix.sys.stat posix.unistd
then
	test_set_prereq CGIT_LUA_AUTH
elif test "$CGIT_HAS_LUA" -eq 1
then
	test_set_prereq CGIT_LUA_NOAUTH
	say 'cgit lua lacks luaossl or luaposix, expecting protected pages refused'
else
	say 'cgit built without lua, checks through cgit skipped'
fi
test "$CGIT_HAS_LUA" -eq 1 && test_set_prereq CGIT_LUA

test_expect_success CGIT_LUA 'point cgit at the unedited auth filter' '
	cat >cgitrc <<-EOF
	virtual-root=/
	cache-size=0
	auth-filter=lua:$EXTENSIONS_DIRECTORY/auth-inline.lua
	repo.url=authy
	repo.path=$PWD/repos/authy/.git
	EOF
'

test_expect_success CGIT_LUA 'an unedited copy protects nothing' '
	cgit_url "authy/log/" >tmp &&
	grep ">guarded commit</a>" tmp
'

test_expect_success CGIT_LUA_NOAUTH 'without the modules a protected repository stays closed' '
	cat >protect.awk <<-\EOF &&
	{ print }
	/^local protected_repos = [{]$/ { print "\t[\"authy\"] = { alice = true }," }
	EOF
	awk -f protect.awk "$EXTENSIONS_DIRECTORY/auth-inline.lua" >guarded.lua &&
	grep "\"authy\"" guarded.lua &&
	cat >guardedrc <<-EOF &&
	virtual-root=/
	cache-size=0
	auth-filter=lua:$PWD/guarded.lua
	repo.url=authy
	repo.path=$PWD/repos/authy/.git
	EOF
	CGIT_CONFIG="$PWD/guardedrc" QUERY_STRING="url=authy/log/" cgit >tmp &&
	! grep "guarded commit" tmp &&
	grep "Unable to complete the request" tmp
'

test_done