From d24a9b8c04c7ccc9b775b4398ac30a8e1ea35c83 Mon Sep 17 00:00:00 2001
From: Peter Bieringer <pb@bieringer.de>
Date: Sat, 18 Jul 2026 15:08:17 +0200
Subject: [PATCH] group: generic tests

---
 radicale/tests/test_auth.py | 56 +++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)

diff --git a/radicale/tests/test_auth.py b/radicale/tests/test_auth.py
index e7e15a47..a3f94cf5 100644
--- a/radicale/tests/test_auth.py
+++ b/radicale/tests/test_auth.py
@@ -149,6 +149,62 @@ class TestBaseAuthRequests(BaseTest):
             check = 401
         self._test_htpasswd("plain", "😀:🔑", "unicode", check=check)
 
+    def test_htpasswd_invalid_user_start_with_at(self) -> None:
+        """user start with @ is not permitted"""
+        self._test_htpasswd("plain", "@domain.example:test", (
+            ("@domain.example", "test", True), ("@domain.example", "test", False)), check=401)
+
+    def test_htpasswd_invalid_user_end_with_at(self) -> None:
+        """user end with @ is not permitted"""
+        self._test_htpasswd("plain", "domain.example@:test", (
+            ("domain.example@", "test", True), ("domain.example@", "test", False)), check=401)
+
+    def test_htpasswd_invalid_user_start_with_encoded_at(self) -> None:
+        """user start with encoded @ is not permitted"""
+        self.configure({"auth": {"urldecode_username": "True"}})
+        self._test_htpasswd("plain", "@domain.example:test", (
+            ("%40domain.example", "test", True), ("%40domain.example", "test", False)), check=401)
+
+    def test_htpasswd_invalid_user_end_with_encoded_at(self) -> None:
+        """user end with encoded @ is not permitted"""
+        self.configure({"auth": {"urldecode_username": "True"}})
+        self._test_htpasswd("plain", "domain.example@:test", (
+            ("domain.example%40", "test", True), ("domain.example%40", "test", False)), check=401)
+
+    def test_htpasswd_invalid_user_with_more_encoded_at(self) -> None:
+        """user with more encoded @ is not permitted"""
+        self.configure({"auth": {"urldecode_username": "True"}})
+        self._test_htpasswd("plain", "user@group@domain.example:test", (
+            ("user%40group%40domain.example", "test", True), ("user%40group%40domain.example", "test", False)), check=401)
+
+    def test_htpasswd_invalid_user_start_with_colon(self) -> None:
+        """user start with : is not permitted"""
+        try:
+            self._test_htpasswd("plain", ":group:test", (
+                (":group", "test", True), (":group", "test", False)), check=401)
+        except RuntimeError:
+            pass
+        else:
+            raise
+
+    def test_htpasswd_invalid_user_start_with_encoded_colon(self) -> None:
+        """user start with encoded : is not permitted"""
+        self.configure({"auth": {"urldecode_username": "True"}})
+        self._test_htpasswd("plain", "'%3Adomain.example:test", (
+            ("%3Adomain.example", "test", True), ("%3Adomain.example", "test", False)), check=401)
+
+    def test_htpasswd_invalid_user_end_with_encoded_colon(self) -> None:
+        """user end with encoded : is not permitted"""
+        self.configure({"auth": {"urldecode_username": "True"}})
+        self._test_htpasswd("plain", "domain.example:test", (
+            ("domain.example%3A", "test", True), ("domain.example%3A", "test", False)), check=401)
+
+    def test_htpasswd_invalid_user_with_any_encoded_colon(self) -> None:
+        """user with any encoded : is not permitted"""
+        self.configure({"auth": {"urldecode_username": "True"}})
+        self._test_htpasswd("plain", "user%3Adomain.example:test", (
+            ("user%3Adomain.example", "test", True), ("user%3Adomain.example", "test", False)), check=401)
+
     def test_htpasswd_md5(self) -> None:
         self._test_htpasswd("md5", "tmp:$apr1$BI7VKCZh$GKW4vq2hqDINMr8uv7lDY/")