1# On a private repo, a reader comments and approves from its pages like2# anyone on a public one. Anyone else, signed in or not, with a token or3# not, gets the response a repo that isn't there gets, byte for byte, and4# nothing is written.5. "$(dirname "$0")/../lib.sh"6user dami7user ana8user cat9repo --private dami/secret10clone dami dami/secret "$T/w/dami"11at "$T/w/dami" commit "first"12ok push_as dami "$T/w/dami" origin main13at "$T/w/dami" git switch -q -c dami/feature14at "$T/w/dami" commit "feature"15ok push_as dami "$T/w/dami" origin dami/feature16ok ssh_as dami readers dami/secret add ana17export FORGE_BASE_URL=https://forge.test18private_server19ana=$(signin ana) || fail "ana can't sign in"20cat=$(signin cat) || fail "cat can't sign in"21cat_token=$(ssh_as cat token 2>/dev/null)22web() { http -s -o "$T/res" -w '%{http_code}' -H "Cookie: __Host-forge=$1" -H 'Origin: https://forge.test' -d "body=hi&csrf=$(csrf_of "$1")" "$PRIV/dami/secret/reviews/1/$2"; }2324eq "$(web "$ana" comment)" 20025eq "$(web "$ana" approve)" 20026has "$FORGE_ROOT/dami/secret.git/forge/comments/1/1" '^user ana$'27has "$FORGE_ROOT/dami/secret.git/forge/reviews/1" '^approve [0-9]+ ana '28has "$FORGE_ROOT/.forge/events.jsonl" '"type":"comment","user":"ana","review":1,"private":true'2930for a in comment approve; do31 response "$PRIV/dami/nope/reviews/1/$a" -X POST -H 'Origin: https://forge.test' -d 'body=hi' >"$T/missing"32 has "$T/missing" '^HTTP/1.1 404 Not Found'33 same() {34 response "$PRIV/dami/secret/reviews/1/$a" -X POST -H 'Origin: https://forge.test' "$@" >"$T/got"35 cmp -s "$T/missing" "$T/got" || { diff "$T/missing" "$T/got" >&2 || true; fail "$a on dami/secret with $* is not the missing repo's 404"; }36 }37 same -d 'body=hi'38 same -H "Cookie: __Host-forge=$cat" -d "body=hi&csrf=$(csrf_of "$cat")"39 same -H "Authorization: Bearer $cat_token" -d 'body=hi'40done41eq "$(ls "$FORGE_ROOT/dami/secret.git/forge/comments/1")" 142eq "$(grep -c '^approve ' "$FORGE_ROOT/dami/secret.git/forge/reviews/1")" 1