run authelia's digest under a real shell, not the service user's nologin

nix/script-tests/oidc-client-secrets.nix

@@ -74,13 +74,13 @@ let
     esac
   '';
 
-  # Runs the command it is given, as util-linux's `script -qec <cmd> /dev/null`
+  # Runs the command it is given with `$SHELL -c`, as util-linux's `script -qec <cmd> /dev/null`
   # does, without needing a pty in the build sandbox. The real pty is checked
   # against the real authelia by hand.
   fakeScript = pkgs.writeShellScriptBin "script" ''
     echo "script $1 $3" >> "$FAKE_AUTHELIA_LOG"
     [ "$1" = -qec ] || exit 99
-    exec ${pkgs.bash}/bin/bash -c "$2"
+    exec "$SHELL" -c "$2"
   '';
 in
 pkgs.runCommand "hyperhive-script-test-oidc-client-secrets"
@@ -88,7 +88,7 @@ pkgs.runCommand "hyperhive-script-test-oidc-client-secrets"
     HELPER = pkgs.writeText "oidc-client-secrets.sh" (
       import ../host-modules/lib/store-seeded-secret.nix { }
       + import ../host-modules/lib/atomic-write-secret.nix { }
-      + import ../host-modules/lib/oidc-client-secrets.nix { }
+      + import ../host-modules/lib/oidc-client-secrets.nix { shell = "${pkgs.bash}/bin/bash"; }
     );
     FAKE_BIN = pkgs.symlinkJoin {
       name = "fake-bao-and-authelia";

nix/script-tests/oidc-client-secrets.sh

@@ -28,6 +28,8 @@ setup() {
   : >"$FAKE_BAO_LOG"
   : >"$FAKE_AUTHELIA_LOG"
   clients=$dir/clients
+  printf '#!/bin/sh\necho "This account is currently not available." >&2\nexit 1\n' >"$dir/nologin"
+  chmod +x "$dir/nologin"
   digest=$clients/$id.digest
   legacy=$clients/$id.secret
   stored=$FAKE_BAO_KV/$(printf '%s' "$leaf" | tr / _)
@@ -35,11 +37,14 @@ setup() {
 
 # run <function> — the function for $id and $leaf, with the stubs first on
 # PATH, after the store login the units make first and, when $PREFETCH is set,
-# `store_prefetch` of the leaf. Sets $rc and $minted.
+# `store_prefetch` of the leaf. `SHELL` is a nologin stub, as the service
+# user's is. Sets $rc and $minted.
 run() {
   minted=$(
     set -e
     PATH="$FAKE_BIN/bin:$PATH"
+    SHELL=$dir/nologin
+    export SHELL
     unset BAO_TOKEN
     # shellcheck source=/dev/null
     . "$HELPER"
@@ -174,6 +179,13 @@ if [ "$(stat -c %a "$digest")" != 600 ]; then fail "digest mode is $(stat -c %a
 if ! logged "oidc client $id: wrote the digest from the secret in the store"; then fail "no info line"; fi
 no_secret_in_argv
 
+setup "mint: the digest is computed although the login shell is nologin"
+printf 'old-secret' >"$stored"
+run mint_client_secret
+expect 0
+digest_is digest-of-old-secret
+if grep -q "not available" "$dir/err" "$dir/out"; then fail "the nologin shell ran"; fi
+
 setup "mint: a plaintext file the store lacks seeds the store once, mints nothing and keeps the digest and the file"
 printf 'old-secret\n' >"$legacy"
 printf 'old-digest\n' >"$digest"