panel session-cookie login (#855) is inert: Lua gate uses a PCRE idiom, cookie handoff unverified

[MagnaCapax]

The opt-in panel session-cookie login from #855 does not work on current main (1ce6a39). It fails closed, so Basic auth keeps protecting the panel and nothing is exposed. The cookie path simply never runs.

Defect 1: PCRE idiom inside a Lua pattern (verified)

scripts/lib/lighttpd/panelSessionGate.lua:25:

local user = path:match("^/user%-([a-z][a-z0-9]*)($|/)")

($|/) is the end-or-slash idiom from lighttpd's PCRE $HTTP["url"] =~ conditions (template.lighttpd uses it correctly for WebDAV, and panelSessionLogin.php:136 uses it for the magnet scope). Lua patterns have no alternation, and $ anchors only as the final character. Here the group matches the literal text $|/, so panel_user() returns nil for every real request and the gate exits at line 131 before any cookie, redirect or login pass-through branch.

Fix:

local user = path:match("^/user%-([a-z][a-z0-9]*)/") or path:match("^/user%-([a-z][a-z0-9]*)$")

Defect 2: REMOTE_USER handoff (reported, not yet reproduced by us)

With defect 1 patched, a reporter tested on stock lighttpd 1.4.69 with the PMSS per-user config (auth.require "method" => "basic", template.lighttpd:75/81, plus the generated auth.extern-authn = "enable" and magnet.attract-raw-url-to block). They report that a valid session cookie returns 401 while correct Basic credentials return 200. Setting REMOTE_USER from either magnet hook did not satisfy auth in their test.

The candidate direction is that an externally set REMOTE_USER needs auth.require "method" => "extern" (the 1.4.69 mod_auth error text lists basic/digest/extern). This is a lead that needs checking on the fleet lighttpd build before the config generator in panelSessionLogin.php changes.

Why the tests stayed green

PanelSessionGateSourceTest.php asserts on source text only. Nothing executes the gate against a URL or stands up lighttpd, so a matcher that never matches and a broken handoff both pass.

Done when

• Defect 1 pattern fixed.
• Defect 2 confirmed or refuted on a real per-user vhost; generator corrected if needed.
• A test executes the gate with mocked lighty.* against representative paths (/user-x, /user-x/, /user-x/panelSessionLogin.php, /user-xfoo). Ideally also a lighttpd smoke test covering cookie→200, no-cookie→401 and HTML→302.

Refs #855

(The daemon was named; it answered to the wrong spell.)

---

_{Tier-3 declared at filing: --why multiple-fix-paths — GH#631 tier gate. Declared fix size: 60 lines vs 37-line body — size gate (operator directive 2026-07-29). Owner: scripts/lib/lighttpd/panelSessionGate.lua in MagnaCapax/PMSS — owner gate.}