1# A token (Authorization: Bearer) comments and approves without a cookie,2# so without a CSRF token: curl and scripts can. A token for one repo works3# on that repo only, and a token in basic auth, which browsers resend by4# themselves, doesn't post.5. "$(dirname "$0")/../lib.sh"6user dami7user ana8repo dami/greet9repo dami/other10for r in greet other; do11 clone dami "dami/$r" "$T/w/$r"12 at "$T/w/$r" commit "first"13 ok push_as dami "$T/w/$r" origin main14 at "$T/w/$r" git switch -q -c dami/feature15 at "$T/w/$r" commit "feature"16 ok push_as dami "$T/w/$r" origin dami/feature17done18export FORGE_BASE_URL=https://forge.test19private_server20all=$(ssh_as ana token 2>/dev/null)21one=$(ssh_as ana token --repo dami/other 2>/dev/null)22code() { http -s -o "$T/res" -w '%{http_code}' -X POST "$@"; }2324eq "$(code -H "Authorization: Bearer $all" -d 'body=From curl' "$PRIV/dami/greet/reviews/1/comment")" 20025has "$FORGE_ROOT/dami/greet.git/forge/comments/1/1" '^user ana$'26has "$FORGE_ROOT/dami/greet.git/forge/comments/1/1" '^From curl$'27eq "$(code -H "Authorization: Bearer $all" -H 'Content-Type: application/json' -d '{}' "$PRIV/dami/greet/reviews/1/approve")" 20028has "$FORGE_ROOT/dami/greet.git/forge/reviews/1" '^approve [0-9]+ ana '2930eq "$(code -H "Authorization: Bearer $one" -d 'body=Wrong repo' "$PRIV/dami/greet/reviews/1/comment")" 40331has "$T/res" '"error":"This token is for dami/other only"'32eq "$(code -H "Authorization: Bearer $one" -d 'body=Right repo' "$PRIV/dami/other/reviews/1/comment")" 20033eq "$(code -u "ana:$all" -d 'body=Basic' "$PRIV/dami/greet/reviews/1/comment")" 40134eq "$(code -H "Authorization: Bearer forge_nope" -d 'body=Revoked' "$PRIV/dami/greet/reviews/1/comment")" 40135eq "$(ls "$FORGE_ROOT/dami/greet.git/forge/comments/1")" 1