import ./make-test-python.nix (
  { pkgs, ... }:
  {
    name = "nginx-auth";

    nodes = {
      webserver =
        { pkgs, lib, ... }:
        {
          services.nginx =
            let
              root = pkgs.runCommand "testdir" { } ''
                mkdir "$out"
                echo hello world > "$out/index.html"
              '';
            in
            {
              enable = true;

              virtualHosts.lockedroot = {
                inherit root;
                basicAuth.alice = "pwofa";
              };

              virtualHosts.lockedsubdir = {
                inherit root;
                locations."/sublocation/" = {
                  alias = "${root}/";
                  basicAuth.bob = "pwofb";
                };
              };
            };
        };
    };

    testScript = ''
      webserver.wait_for_unit("nginx")
      webserver.wait_for_open_port(80)

      webserver.fail("curl --fail --resolve lockedroot:80:127.0.0.1 http://lockedroot")
      webserver.succeed(
          "curl --fail --resolve lockedroot:80:127.0.0.1 http://alice:pwofa@lockedroot"
      )

      webserver.succeed("curl --fail --resolve lockedsubdir:80:127.0.0.1 http://lockedsubdir")
      webserver.fail(
          "curl --fail --resolve lockedsubdir:80:127.0.0.1 http://lockedsubdir/sublocation/index.html"
      )
      webserver.succeed(
          "curl --fail --resolve lockedsubdir:80:127.0.0.1 http://bob:pwofb@lockedsubdir/sublocation/index.html"
      )
    '';
  }
)