fix(auth): remove auto-enable token auth logic

Signed-off-by: Noste <83548733+Noooste@users.noreply.github.com>

README.md

@@ -1,6 +1,6 @@
 <p align="center">
   <a href="https://github.com/Noooste/garage-ui/actions/workflows/build.yml"><img src="https://github.com/Noooste/garage-ui/actions/workflows/build.yml/badge.svg" alt="Docker Build" /></a>
-  <a href="https://github.com/Noooste/garage-ui/actions/workflows/release.yml"><img src="https://github.com/Noooste/garage-ui/actions/workflows/release.yml/badge.svg" alt="Helm Chart" /></a>
+  <a href="https://github.com/Noooste/garage-ui/actions/workflows/chart-release.yml"><img src="https://github.com/Noooste/garage-ui/actions/workflows/chart-release.yml/badge.svg" alt="Helm Chart" /></a>
   <a href="https://codecov.io/gh/Noooste/garage-ui"><img src="https://codecov.io/gh/Noooste/garage-ui/branch/main/graph/badge.svg" alt="Coverage" /></a>
   <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="License: MIT" /></a>
   <a href="https://go.dev/"><img src="https://img.shields.io/badge/Go-1.25%2B-00ADD8?logo=go" alt="Go Version" /></a>

backend/internal/config/config.go

@@ -328,15 +328,6 @@ func (c *Config) Validate() error {
 	return nil
 }
 
-// ResolveTokenAuth auto-enables token auth when no other auth method is
-// configured, unless it was explicitly set. This ensures the app never
-// starts without a login wall.
-func (c *Config) ResolveTokenAuth() {
-	if !c.Auth.Admin.Enabled && !c.Auth.OIDC.Enabled && !c.Auth.Token.Enabled {
-		c.Auth.Token.Enabled = true
-	}
-}
-
 // GetAddress returns the full server address (host:port)
 func (c *Config) GetAddress() string {
 	return fmt.Sprintf("%s:%d", c.Server.Host, c.Server.Port)

backend/internal/config/config_test.go

@@ -485,46 +485,6 @@ func TestLoad_EnvOverridesToml(t *testing.T) {
 	}
 }
 
-func TestValidate_TokenAuthAutoEnabled(t *testing.T) {
-	cfg := validBaseConfig()
-	cfg.ResolveTokenAuth()
-	if !cfg.Auth.Token.Enabled {
-		t.Error("expected token auth to be auto-enabled when no other auth is configured")
-	}
-}
-
-func TestValidate_TokenAuthNotAutoEnabledWhenAdminEnabled(t *testing.T) {
-	cfg := validBaseConfig()
-	cfg.Auth.Admin.Enabled = true
-	cfg.Auth.Admin.Username = "u"
-	cfg.Auth.Admin.Password = "p"
-	cfg.ResolveTokenAuth()
-	if cfg.Auth.Token.Enabled {
-		t.Error("expected token auth to stay disabled when admin auth is configured")
-	}
-}
-
-func TestValidate_TokenAuthNotAutoEnabledWhenOIDCEnabled(t *testing.T) {
-	cfg := validBaseConfig()
-	applyValidOIDC(&cfg)
-	cfg.ResolveTokenAuth()
-	if cfg.Auth.Token.Enabled {
-		t.Error("expected token auth to stay disabled when OIDC is configured")
-	}
-}
-
-func TestValidate_TokenAuthExplicitlyEnabled(t *testing.T) {
-	cfg := validBaseConfig()
-	cfg.Auth.Admin.Enabled = true
-	cfg.Auth.Admin.Username = "u"
-	cfg.Auth.Admin.Password = "p"
-	cfg.Auth.Token.Enabled = true
-	cfg.ResolveTokenAuth()
-	if !cfg.Auth.Token.Enabled {
-		t.Error("expected token auth to stay enabled when explicitly set")
-	}
-}
-
 func TestEffectiveAdminRoles(t *testing.T) {
 	tests := []struct {
 		name       string

backend/main.go

@@ -87,9 +87,6 @@ func main() {
 		logger.Get().Fatal().Err(err).Str("config_path", *configPath).Msg("Failed to load configuration")
 	}
 
-	// Auto-enable token auth if no other auth method is configured
-	cfg.ResolveTokenAuth()
-
 	// Initialize logger with configuration from config file
 	logger.Init(logger.Config{
 		Level:  cfg.Logging.Level,