index : cgit

#!/bin/sh

# Checks auth-file.lua and auth-inline.lua, the shipped auth filters, which
# differ only in where accounts live. The unit checks meet luaossl and
# luaposix with deterministic stand-ins from the harness, proving tampered
# and expired cookies turned away, header injection stripped, unsafe
# redirects refused and the login flows answering as documented. Through cgit
# itself an unedited copy protects nothing, with or without the modules, and
# when the binary's own Lua lacks them a protected repository stays closed.

test_description='Check the shipped auth extensions'
CGIT_TEST_NO_CREATE_REPOS=YesPlease
. ./setup.sh
. "$TEST_OUTPUT_DIRECTORY/extensions/lib.sh"

for lua in $interpreters
do
	for variant in inline file
	do
		test_expect_success "auth-$variant checks under $lua" '
			mkdir "unit-$lua-$variant" &&
			"$lua" "$EXT_TEST_DIRECTORY/test-auth.lua" \
				"$EXTENSIONS_DIRECTORY/auth-$variant.lua" $variant "$PWD/unit-$lua-$variant"
		'
	done
done

test_expect_success 'create a repository with one commit' '
	test_create_repo repos/authy &&
	(
		cd repos/authy &&
		echo content >file &&
		git add file &&
		git commit -m "guarded commit"
	)
'

if test "$CGIT_HAS_LUA" -eq 1 &&
	! cgit_lua_probe "$PWD/repos/authy/.git" openssl.rand openssl.hmac posix.sys.stat posix.unistd
then
	test_set_prereq CGIT_LUA_NOAUTH
	say 'cgit lua lacks luaossl or luaposix, expecting protected pages refused'
fi

test_expect_success CGIT_LUA 'point cgit at the unedited auth filter' '
	cat >cgitrc <<-EOF
	virtual-root=/
	cache-size=0
	auth-filter=lua:$EXTENSIONS_DIRECTORY/auth-inline.lua
	repo.url=authy
	repo.path=$PWD/repos/authy/.git
	EOF
'

test_expect_success CGIT_LUA 'an unedited copy protects nothing' '
	cgit_url "authy/log/" >tmp &&
	grep ">guarded commit</a>" tmp
'

test_expect_success CGIT_LUA_NOAUTH 'without the modules a protected repository stays closed' '
	cat >protect.awk <<-\EOF &&
	{ print }
	/^local protected_repos = [{]$/ { print "\t[\"authy\"] = { alice = true }," }
	EOF
	awk -f protect.awk "$EXTENSIONS_DIRECTORY/auth-inline.lua" >guarded.lua &&
	grep "\"authy\"" guarded.lua &&
	cat >guardedrc <<-EOF &&
	virtual-root=/
	cache-size=0
	auth-filter=lua:$PWD/guarded.lua
	repo.url=authy
	repo.path=$PWD/repos/authy/.git
	EOF
	cgit_rc guardedrc "url=authy/log/" >tmp 2>err &&
	! grep "guarded commit" tmp &&
	grep "<p class=.login-error. role=.alert.>Logins are unavailable" tmp &&
	grep "^\[cgit\] " err
'

# The access lists are keyed by a repository's url, which repo.name and
# section-from-path can make differ from the name the index shows, so a
# filter handed the name would leave a protected repository public.
test_expect_success 'an auth filter is handed the repository url' '
	write_script seen.sh <<-\EOF &&
	test "$1" = authenticate-cookie && printf "%s\n" "$9" >seen
	exit 1
	EOF
	cgitrc_repo seenrc team/tools.git "auth-filter=exec:$PWD/seen.sh" \
		"repo.path=$PWD/repos/authy/.git" "repo.name=tools.git" &&
	echo team/tools.git >expect &&
	cgit_ok seenrc "url=team/tools.git/log/" >tmp &&
	grep ">guarded commit</a>" tmp &&
	test_cmp expect seen &&
	rm seen &&
	cgit_ok seenrc "r=team/tools.git&p=log" >tmp &&
	grep ">guarded commit</a>" tmp &&
	test_cmp expect seen &&
	mkdir -p scan/team &&
	git clone -q --bare repos/authy scan/team/tools.git &&
	cat >scanrc <<-EOF &&
	virtual-root=/
	cache-size=0
	auth-filter=exec:$PWD/seen.sh
	section-from-path=1
	scan-path=$PWD/scan
	EOF
	cgit_ok scanrc "" >tmp &&
	grep ">tools.git</a>" tmp &&
	rm seen &&
	cgit_ok scanrc "url=team/tools.git/log/" >tmp &&
	grep ">guarded commit</a>" tmp &&
	test_cmp expect seen
'

# A filter of the test's own turns every visitor away, which needs no Lua.
# Until a visitor is let in, the header of a protected repository shows the
# site's description in place of its own and no owner, even for a
# repository hidden from the index.
test_expect_success 'the login page keeps the repository to itself' '
	write_script deny.sh <<-\EOF &&
	test "$1" = body && echo "<p>sign in</p>"
	exit 0
	EOF
	cat >denyrc <<-EOF &&
	virtual-root=/
	cache-size=0
	root-desc=the whole site
	auth-filter=exec:$PWD/deny.sh
	repo.url=authy
	repo.path=$PWD/repos/authy/.git
	repo.desc=the secret plan
	repo.owner=Mallory Owner
	repo.hide=1
	EOF
	cgit_rc denyrc "url=authy/log/" >tmp &&
	grep "<p>sign in</p>" tmp &&
	grep "<p class=.sub desc.>the whole site</p>" tmp &&
	grep "<meta name=.description. content=.the whole site.>" tmp &&
	! grep "secret plan" tmp &&
	! grep "Mallory" tmp
'

# The login page answers in place of whatever page was asked for, so it is
# kept out of a search index, whatever the site allows for its own pages.
test_expect_success 'the login page asks not to be indexed' '
	cgit_rc denyrc "url=authy/log/" >tmp &&
	grep "^Status: 200" tmp &&
	grep "<meta name=.robots. content=.noindex, nofollow.>" tmp &&
	{
		echo "robots=" &&
		cat denyrc
	} >norobotsrc &&
	cgit_rc norobotsrc "url=authy/log/" >tmp &&
	grep "<meta name=.robots. content=.noindex, nofollow.>" tmp
'

test_done