Using .htaccess and authfile to protect different parts of a CGI script

I am setting up a mercurial server on my shared hosting account with bluehost. I do have ssh access but do not have access to the apache config. Basically the mercurial server runs off one single cgi script, in my case domain.com/repos/hg.cgi (for access to all repositories on the server). I have protected the "repos" directory using a .htaccess file and an auth file.

But the way mercurial works, that for example the repository "stack" is accessed like this: domain.com/repos/hg.cgi/stack

This poses a problem, since authentication happened in the repos directory, and all users that have access to that now have access to all the repositories.

Is there a way to protect the i开发者_C百科ndividual repositories using just a .htaccess file?

---

Within each repository's .hg/hgrc file you can list users that can and can't access it:

[web]
allow_read = you,yourfriend
allow_push = you

---

If you only want the localhost to access it use

<File "/path/to/repos/hg.cgi/stack">
order deny, allow
deny from all
allow from 127.0.0.1
</File>

---

On a shared hosting system where you have SSH access, if you are interested, you can share repositories via shared SSH using hg-gateway. That way you dont have to deal with typing or saving https passwords.