1# Without a live invite, posting a key to /login/invite/accept gets the same2# answer whatever the key: one already on the forge, a new one or not a key3# at all. So the page can't be asked whether a key has an account. The4# shell side (forge user accept) checks the code first too.5. "$(dirname "$0")/../lib.sh"6user cat7export FORGE_BASE_URL=https://forge.test8private_server9ssh-keygen -q -t ed25519 -N '' -C fox -f "$T/keys/fox"10accept() {11 node -e 'console.log(JSON.stringify({ code: process.argv[1], key: process.argv[2] }))' -- "$1" "$2" >"$T/body"12 http -s -i -H 'Origin: https://forge.test' -H 'Content-Type: application/json' -d @"$T/body" "$PRIV/login/invite/accept" | grep -av '^Date: '13}14accept nonsense "$(cat "$T/keys/cat.pub")" >"$T/known"15has "$T/known" '^HTTP/1.1 400 '16has "$T/known" 'expired, been used or been taken back'17lacks "$T/known" 'already on this forge'18for key in "$(cat "$T/keys/fox.pub")" hello ""; do19 accept nonsense "$key" >"$T/other"20 cmp -s "$T/known" "$T/other" || { diff "$T/known" "$T/other" >&2 || true; fail "a dead invite answers differently for key '$key'"; }21done22# A code that was live and is used up answers the same.23ok forge user invite fox24code=$(sed -n 's/^ .*#invite=//p' "$T_LOG")25ok forge user invites rm fox26accept "$code" "$(cat "$T/keys/cat.pub")" >"$T/other"27cmp -s "$T/known" "$T/other" || fail "a taken-back invite answers differently"28printf '%s\n%s\n' nonsense "$(cat "$T/keys/cat.pub")" | forge user accept >"$T_LOG" 2>&1 && fail "user accept took a dead code"29has "$T_LOG" 'expired, been used or been taken back'30lacks "$T_LOG" 'already on this forge'