1# A comment or approval that rides on the session cookie must come from2# the forge's own pages: the Origin is the forge's and the post carries the3# session's CSRF token, which another session's token isn't. Signed out,4# nothing is posted. None of these write anything.5. "$(dirname "$0")/../lib.sh"6user dami7user ana8user cat9repo dami/greet10clone dami dami/greet "$T/w/dami"11at "$T/w/dami" commit "first"12ok push_as dami "$T/w/dami" origin main13at "$T/w/dami" git switch -q -c dami/feature14at "$T/w/dami" commit "feature"15ok push_as dami "$T/w/dami" origin dami/feature16export FORGE_BASE_URL=https://forge.test17private_server18ana=$(signin ana) || fail "ana can't sign in"19cat=$(signin cat) || fail "cat can't sign in"20csrf=$(csrf_of "$ana")21[ -n "$csrf" ] || fail "no csrf token for ana"22[ "$csrf" != "$(csrf_of "$cat")" ] || fail "two sessions have one csrf token"23code() { http -s -o "$T/res" -w '%{http_code}' -X POST "$@"; }24for a in comment approve; do25 u=$PRIV/dami/greet/reviews/1/$a26 eq "$(code -H "Cookie: __Host-forge=$ana" -H 'Origin: https://forge.test' -d 'body=hi' "$u")" 40327 has "$T/res" '"error":"This page is out of date: reload it and try again"'28 eq "$(code -H "Cookie: __Host-forge=$ana" -H 'Origin: https://forge.test' -d "body=hi&csrf=$(csrf_of "$cat")" "$u")" 40329 eq "$(code -H "Cookie: __Host-forge=$ana" -H 'Origin: https://evil.test' -d "body=hi&csrf=$csrf" "$u")" 40330 has "$T/res" '"error":"not from this forge"'31 eq "$(code -H "Cookie: __Host-forge=$ana" -d "body=hi&csrf=$csrf" "$u")" 40332 eq "$(code -H 'Origin: https://forge.test' -d "body=hi&csrf=$csrf" "$u")" 40133 has "$T/res" "\"error\":\"Sign in to $a\""34 eq "$(code -H 'Cookie: __Host-forge=nope' -H 'Origin: https://forge.test' -d "body=hi&csrf=$csrf" "$u")" 40135done36missing "$FORGE_ROOT/dami/greet.git/forge/comments/1"37lacks "$FORGE_ROOT/dami/greet.git/forge/reviews/1" '^approve '38# The real thing, to show the rest were refused for what they lacked.39eq "$(code -H "Cookie: __Host-forge=$ana" -H 'Origin: https://forge.test' -d "body=hi&csrf=$csrf" "$PRIV/dami/greet/reviews/1/comment")" 20040exists "$FORGE_ROOT/dami/greet.git/forge/comments/1/1"4142# who is asking, for the page's script: never kept by a cache.43http -s -D "$T/h" -o "$T/who" -H "Cookie: __Host-forge=$ana" "$PRIV/login/whoami"44has "$T/h" '^Cache-Control: private, no-store'45has "$T/h" '^Vary: Cookie'46has "$T/who" "^\\{\"user\":\"ana\",\"csrf\":\"$csrf\"\\}\$"47http -s -o "$T/who" "$PRIV/login/whoami"48has "$T/who" '^\{"user":null\}$'