From 1b645b0c2c6e05dea98a7fc5d7595ca015913770 Mon Sep 17 00:00:00 2001
From: Noste <83548733+Noooste@users.noreply.github.com>
Date: Sat, 23 May 2026 12:46:38 +0200
Subject: [PATCH] fix(auth): remove auto-enable token auth logic

Signed-off-by: Noste <83548733+Noooste@users.noreply.github.com>
---
 README.md                              |  2 +-
 backend/internal/config/config.go      |  9 ------
 backend/internal/config/config_test.go | 40 --------------------------
 backend/main.go                        |  3 --
 4 files changed, 1 insertion(+), 53 deletions(-)

diff --git a/README.md b/README.md
index 48aafea..529f005 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 <p align="center">
   <a href="https://github.com/Noooste/garage-ui/actions/workflows/build.yml"><img src="https://github.com/Noooste/garage-ui/actions/workflows/build.yml/badge.svg" alt="Docker Build" /></a>
-  <a href="https://github.com/Noooste/garage-ui/actions/workflows/release.yml"><img src="https://github.com/Noooste/garage-ui/actions/workflows/release.yml/badge.svg" alt="Helm Chart" /></a>
+  <a href="https://github.com/Noooste/garage-ui/actions/workflows/chart-release.yml"><img src="https://github.com/Noooste/garage-ui/actions/workflows/chart-release.yml/badge.svg" alt="Helm Chart" /></a>
   <a href="https://codecov.io/gh/Noooste/garage-ui"><img src="https://codecov.io/gh/Noooste/garage-ui/branch/main/graph/badge.svg" alt="Coverage" /></a>
   <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="License: MIT" /></a>
   <a href="https://go.dev/"><img src="https://img.shields.io/badge/Go-1.25%2B-00ADD8?logo=go" alt="Go Version" /></a>
diff --git a/backend/internal/config/config.go b/backend/internal/config/config.go
index 63164d5..b32e2ec 100644
--- a/backend/internal/config/config.go
+++ b/backend/internal/config/config.go
@@ -328,15 +328,6 @@ func (c *Config) Validate() error {
 	return nil
 }
 
-// ResolveTokenAuth auto-enables token auth when no other auth method is
-// configured, unless it was explicitly set. This ensures the app never
-// starts without a login wall.
-func (c *Config) ResolveTokenAuth() {
-	if !c.Auth.Admin.Enabled && !c.Auth.OIDC.Enabled && !c.Auth.Token.Enabled {
-		c.Auth.Token.Enabled = true
-	}
-}
-
 // GetAddress returns the full server address (host:port)
 func (c *Config) GetAddress() string {
 	return fmt.Sprintf("%s:%d", c.Server.Host, c.Server.Port)
diff --git a/backend/internal/config/config_test.go b/backend/internal/config/config_test.go
index c1716fc..8ebb4ce 100644
--- a/backend/internal/config/config_test.go
+++ b/backend/internal/config/config_test.go
@@ -485,46 +485,6 @@ func TestLoad_EnvOverridesToml(t *testing.T) {
 	}
 }
 
-func TestValidate_TokenAuthAutoEnabled(t *testing.T) {
-	cfg := validBaseConfig()
-	cfg.ResolveTokenAuth()
-	if !cfg.Auth.Token.Enabled {
-		t.Error("expected token auth to be auto-enabled when no other auth is configured")
-	}
-}
-
-func TestValidate_TokenAuthNotAutoEnabledWhenAdminEnabled(t *testing.T) {
-	cfg := validBaseConfig()
-	cfg.Auth.Admin.Enabled = true
-	cfg.Auth.Admin.Username = "u"
-	cfg.Auth.Admin.Password = "p"
-	cfg.ResolveTokenAuth()
-	if cfg.Auth.Token.Enabled {
-		t.Error("expected token auth to stay disabled when admin auth is configured")
-	}
-}
-
-func TestValidate_TokenAuthNotAutoEnabledWhenOIDCEnabled(t *testing.T) {
-	cfg := validBaseConfig()
-	applyValidOIDC(&cfg)
-	cfg.ResolveTokenAuth()
-	if cfg.Auth.Token.Enabled {
-		t.Error("expected token auth to stay disabled when OIDC is configured")
-	}
-}
-
-func TestValidate_TokenAuthExplicitlyEnabled(t *testing.T) {
-	cfg := validBaseConfig()
-	cfg.Auth.Admin.Enabled = true
-	cfg.Auth.Admin.Username = "u"
-	cfg.Auth.Admin.Password = "p"
-	cfg.Auth.Token.Enabled = true
-	cfg.ResolveTokenAuth()
-	if !cfg.Auth.Token.Enabled {
-		t.Error("expected token auth to stay enabled when explicitly set")
-	}
-}
-
 func TestEffectiveAdminRoles(t *testing.T) {
 	tests := []struct {
 		name       string
diff --git a/backend/main.go b/backend/main.go
index 98d146f..f22302a 100644
--- a/backend/main.go
+++ b/backend/main.go
@@ -87,9 +87,6 @@ func main() {
 		logger.Get().Fatal().Err(err).Str("config_path", *configPath).Msg("Failed to load configuration")
 	}
 
-	// Auto-enable token auth if no other auth method is configured
-	cfg.ResolveTokenAuth()
-
 	// Initialize logger with configuration from config file
 	logger.Init(logger.Config{
 		Level:  cfg.Logging.Level,