1# A private repo's release files are in the private root, and the private2# server gives them to its readers, with a token (curl, a token for that3# repo) or signed in, as Caddy gives a public repo's: attachments, not4# sniffed, revalidated, in byte ranges. Anyone else gets the 404 of a file5# that isn't there, byte for byte. They are not in www, so the mirror,6# which syncs www, never sees them.7. "$(dirname "$0")/../lib.sh"8user dami9user ana10user cat11repo --private dami/secret12repo dami/open13ok ssh_as dami readers dami/secret add ana14clone dami dami/secret "$T/w/d"15at "$T/w/d" commit "first"16at "$T/w/d" git tag v117ok push_as dami "$T/w/d" origin main18mkdir "$T/f"19printf 'secret tool, 0123456789\n' >"$T/f/tool.html"20FORGE_USER=dami ok at "$T/w/d" "$FORGE" release publish v1 "$T/f/tool.html"21build22p=$FORGE_ROOT/.forge/private/www/dami/secret23ok cmp "$T/f/tool.html" "$p/releases/download/v1/tool.html"24ok cmp "$T/f/tool.html" "$p/releases/download/latest/tool.html"25has "$p/releases/index.html" 'href="/dami/secret/releases/download/v1/tool.html"'26missing "$FORGE_WWW/dami/secret"27if find "$FORGE_WWW" -name 'tool.html' | grep -q .; then fail "a private release file is in www"; fi2829export FORGE_BASE_URL=https://forge.test30private_server31u=$PRIV/dami/secret/releases/download/v1/tool.html32tok=$(ssh_as ana token --repo dami/secret 2>/dev/null)33http -s -D "$T/h" -o "$T/got" -u "ana:$tok" "$u"34has "$T/h" '^HTTP/1.1 200'35has "$T/h" '^Content-Disposition: attachment'36has "$T/h" '^X-Content-Type-Options: nosniff'37has "$T/h" '^Cache-Control: private, no-cache'38has "$T/h" '^Accept-Ranges: bytes'39ok cmp "$T/f/tool.html" "$T/got"40http -s -D "$T/h" -o "$T/part" -H "Authorization: Bearer $tok" -H 'Range: bytes=7-10' "$u"41has "$T/h" '^HTTP/1.1 206'42has "$T/h" "^Content-Range: bytes 7-10/$(wc -c <"$T/f/tool.html" | tr -d ' ')"43has "$T/h" '^Content-Disposition: attachment'44eq "$(cat "$T/part")" "tool"45etag=$(sed -n 's/^ETag: //p' "$T/h" | tr -d '\r')46eq "$(http -s -o /dev/null -w '%{http_code}' -H "Authorization: Bearer $tok" -H "If-None-Match: $etag" "$u")" 30447eq "$(http -s -o /dev/null -w '%{http_code}' -H "Authorization: Bearer $tok" "$PRIV/dami/secret/releases/download/v1/SHA256SUMS.sig")" 2004849# Signed in with a passkey.50code=$(ssh_as ana passkey | sed -n 's/^ .*#enroll=//p')51ana=$(node "$T_HOME/test/authenticator.ts" enroll "$PRIV" "$code" "$T/ana.key") || fail "ana can't sign in"52http -s -D "$T/h" -o "$T/got" -H "Cookie: __Host-forge=$ana" -H 'Range: bytes=0-5' "$u"53has "$T/h" '^HTTP/1.1 206'54has "$T/h" '^Content-Disposition: attachment'55has "$T/h" '^X-Content-Type-Options: nosniff'56eq "$(cat "$T/got")" "secret"5758# Anyone else: the missing file's 404.59response "$PRIV/dami/secret/releases/download/v1/nope" -H "Authorization: Bearer $tok" >"$T/missing"60has "$T/missing" '^HTTP/1.1 404'61cat_tok=$(ssh_as cat token 2>/dev/null)62code=$(ssh_as cat passkey | sed -n 's/^ .*#enroll=//p')63cat=$(node "$T_HOME/test/authenticator.ts" enroll "$PRIV" "$code" "$T/cat.key") || fail "cat can't sign in"64elsewhere=$(ssh_as ana token --repo dami/open 2>/dev/null)65same() {66 response "$u" "$@" >"$T/got"67 cmp -s "$T/missing" "$T/got" || { diff "$T/missing" "$T/got" >&2 || true; fail "not the missing file's 404: $*"; }68}69same70same -H 'Range: bytes=0-5'71same -H "Authorization: Bearer $cat_tok"72same -u "cat:$cat_tok"73same -H "Cookie: __Host-forge=$cat"74same -H "Authorization: Bearer $elsewhere"7576# The mirror (a stand-in rclone, its bucket a directory) gets none of it.77fake_rclone78ok forge mirror79find "$T/bucket" >"$T/bucket.list"80has "$T/bucket.list" '/index\.html$'81lacks "$T/bucket.list" 'secret|tool'