From 8853933adcfec3010300571709aaf86b0ec5f326 Mon Sep 17 00:00:00 2001
From: ryan <ryan@arctel.net>
Date: Tue, 26 May 2026 10:29:40 +0800
Subject: [PATCH] =?UTF-8?q?[=E4=BC=98=E5=8C=96]=20=E4=BF=AE=E5=A4=8D?=
 =?UTF-8?q?=E5=9F=BA=E6=9C=AC=E9=89=B4=E6=9D=83=E9=80=BB=E8=BE=91=EF=BC=8C?=
 =?UTF-8?q?=E7=A1=AE=E4=BF=9D=20Lua=20=E5=9D=97=E6=AD=A3=E7=A1=AE=E5=85=B3?=
 =?UTF-8?q?=E9=97=AD=E5=B9=B6=E6=B7=BB=E5=8A=A0=E7=9B=B8=E5=85=B3=E6=B5=8B?=
 =?UTF-8?q?=E8=AF=95=E7=94=A8=E4=BE=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 openflare_server/service/config_version.go    |  2 +-
 openflare_server/service/https_phase1_test.go | 48 +++++++++++++++++++
 2 files changed, 49 insertions(+), 1 deletion(-)

diff --git a/openflare_server/service/config_version.go b/openflare_server/service/config_version.go
index e4ca8592..97950966 100644
--- a/openflare_server/service/config_version.go
+++ b/openflare_server/service/config_version.go
@@ -1135,7 +1135,7 @@ func renderBasicAuthBlock(enabled bool, username, password string) string {
             if auth ~= "Basic %s" then
                 ngx.header["WWW-Authenticate"] = 'Basic realm="Restricted"'
                 return ngx.exit(401)
-            }
+            end
         }
 `, encoded)
 }
diff --git a/openflare_server/service/https_phase1_test.go b/openflare_server/service/https_phase1_test.go
index 200e5796..798836fc 100644
--- a/openflare_server/service/https_phase1_test.go
+++ b/openflare_server/service/https_phase1_test.go
@@ -1026,6 +1026,54 @@ func TestPublishConfigVersionDetectsPoWChanges(t *testing.T) {
 	}
 }
 
+func TestPublishConfigVersionRendersBasicAuthWithPoW(t *testing.T) {
+	setupServiceTestDB(t)
+
+	certPEM, keyPEM := generateCertificatePair(t, []string{"xbot.example.com"})
+	certificate, err := CreateTLSCertificate(TLSCertificateInput{
+		Name:    "xbot-example",
+		CertPEM: certPEM,
+		KeyPEM:  keyPEM,
+	})
+	if err != nil {
+		t.Fatalf("CreateTLSCertificate failed: %v", err)
+	}
+
+	_, err = CreateProxyRoute(ProxyRouteInput{
+		Domain:            "xbot.example.com",
+		OriginURL:         "http://c1:36185",
+		Enabled:           true,
+		EnableHTTPS:       true,
+		CertID:            &certificate.ID,
+		RedirectHTTP:      true,
+		PoWEnabled:        true,
+		PoWConfig:         `{"difficulty":4,"algorithm":"fast","session_ttl":600,"challenge_ttl":300,"whitelist":{"ips":[],"ip_cidrs":[],"paths":[],"path_regexes":[],"user_agents":[]},"blacklist":{"ips":[],"ip_cidrs":[],"paths":[],"path_regexes":[],"user_agents":[]}}`,
+		BasicAuthEnabled:  true,
+		BasicAuthUsername: "admin",
+		BasicAuthPassword: "123",
+	})
+	if err != nil {
+		t.Fatalf("CreateProxyRoute failed: %v", err)
+	}
+
+	result, err := PublishConfigVersion("root", false)
+	if err != nil {
+		t.Fatalf("PublishConfigVersion failed: %v", err)
+	}
+	if !strings.Contains(result.Version.RenderedConfig, `if auth ~= "Basic YWRtaW46MTIz" then`) {
+		t.Fatal("expected rendered config to include encoded basic auth credentials")
+	}
+	if !strings.Contains(result.Version.RenderedConfig, "                return ngx.exit(401)\n            end\n        }\n") {
+		t.Fatal("expected rendered basic auth Lua block to close the if statement before the nginx block")
+	}
+	if !strings.Contains(result.Version.RenderedConfig, "    access_by_lua_file __OPENFLARE_LUA_DIR__/pow/check.lua;") {
+		t.Fatal("expected PoW access handler to remain at server scope")
+	}
+	if !strings.Contains(result.Version.RenderedConfig, "proxy_pass http://backend_xbot_example_com_1;") {
+		t.Fatal("expected proxy_pass to stay in the root location after basic auth")
+	}
+}
+
 func TestRenderConfigUsesDefaultServerFallback(t *testing.T) {
 	setupServiceTestDB(t)