run authelia's digest under a real shell, not the service user's nologin

nix/script-tests/oidc-client-secrets.sh

@@ -28,6 +28,8 @@ setup() {
   : >"$FAKE_BAO_LOG"
   : >"$FAKE_AUTHELIA_LOG"
   clients=$dir/clients
+  printf '#!/bin/sh\necho "This account is currently not available." >&2\nexit 1\n' >"$dir/nologin"
+  chmod +x "$dir/nologin"
   digest=$clients/$id.digest
   legacy=$clients/$id.secret
   stored=$FAKE_BAO_KV/$(printf '%s' "$leaf" | tr / _)
@@ -35,11 +37,14 @@ setup() {
 
 # run <function> — the function for $id and $leaf, with the stubs first on
 # PATH, after the store login the units make first and, when $PREFETCH is set,
-# `store_prefetch` of the leaf. Sets $rc and $minted.
+# `store_prefetch` of the leaf. `SHELL` is a nologin stub, as the service
+# user's is. Sets $rc and $minted.
 run() {
   minted=$(
     set -e
     PATH="$FAKE_BIN/bin:$PATH"
+    SHELL=$dir/nologin
+    export SHELL
     unset BAO_TOKEN
     # shellcheck source=/dev/null
     . "$HELPER"
@@ -174,6 +179,13 @@ if [ "$(stat -c %a "$digest")" != 600 ]; then fail "digest mode is $(stat -c %a
 if ! logged "oidc client $id: wrote the digest from the secret in the store"; then fail "no info line"; fi
 no_secret_in_argv
 
+setup "mint: the digest is computed although the login shell is nologin"
+printf 'old-secret' >"$stored"
+run mint_client_secret
+expect 0
+digest_is digest-of-old-secret
+if grep -q "not available" "$dir/err" "$dir/out"; then fail "the nologin shell ran"; fi
+
 setup "mint: a plaintext file the store lacks seeds the store once, mints nothing and keeps the digest and the file"
 printf 'old-secret\n' >"$legacy"
 printf 'old-digest\n' >"$digest"