feat: add garage.toml support (#30)

backend/internal/auth/token_test.go

@@ -0,0 +1,29 @@
+package auth
+
+import (
+	"crypto/subtle"
+	"testing"
+)
+
+func TestValidateAdminToken(t *testing.T) {
+	tests := []struct {
+		name       string
+		configured string
+		provided   string
+		want       bool
+	}{
+		{"correct token", "my-secret-token", "my-secret-token", true},
+		{"wrong token", "my-secret-token", "wrong-token", false},
+		{"empty provided", "my-secret-token", "", false},
+		{"empty configured", "", "any-token", false},
+		{"both empty", "", "", true},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := subtle.ConstantTimeCompare([]byte(tc.configured), []byte(tc.provided)) == 1
+			if got != tc.want {
+				t.Errorf("ValidateAdminToken(%q, %q) = %v, want %v", tc.configured, tc.provided, got, tc.want)
+			}
+		})
+	}
+}

backend/internal/config/config.go

@@ -46,6 +46,7 @@ type GarageConfig struct {
 type AuthConfig struct {
 	Admin      AdminAuthConfig `mapstructure:"admin"`
 	OIDC       OIDCConfig      `mapstructure:"oidc"`
+	Token      TokenAuthConfig `mapstructure:"token"`
 	JWTPrivKey string          `mapstructure:"jwt_private_key"` // Ed25519 private key in PEM format for JWT signing (64 bytes)
 }
 
@@ -56,6 +57,12 @@ type AdminAuthConfig struct {
 	Password string `mapstructure:"password"`
 }
 
+// TokenAuthConfig contains admin token authentication settings.
+// When enabled, users can log in using the Garage admin token.
+type TokenAuthConfig struct {
+	Enabled bool `mapstructure:"enabled"`
+}
+
 // OIDCConfig contains OIDC authentication settings
 type OIDCConfig struct {
 	Enabled           bool     `mapstructure:"enabled"`
@@ -95,8 +102,28 @@ type LoggingConfig struct {
 	Format string `mapstructure:"format"`
 }
 
+// LoadOption configures optional behaviour of Load.
+type LoadOption func(*loadOptions)
+
+type loadOptions struct {
+	garageTomlPath string
+}
+
+// WithGarageToml tells Load to parse a garage.toml file and use its values as
+// lowest-priority defaults (below YAML, below env vars).
+func WithGarageToml(path string) LoadOption {
+	return func(o *loadOptions) {
+		o.garageTomlPath = path
+	}
+}
+
 // Load reads the configuration from the specified file
-func Load(configPath string) (*Config, error) {
+func Load(configPath string, opts ...LoadOption) (*Config, error) {
+	var lo loadOptions
+	for _, fn := range opts {
+		fn(&lo)
+	}
+
 	// Set default config file name if not specified
 	if configPath == "" {
 		configPath = "config.yaml"
@@ -106,6 +133,28 @@ func Load(configPath string) (*Config, error) {
 	viper.SetConfigFile(configPath)
 	viper.SetConfigType("yaml")
 
+	// Built-in defaults (lowest priority)
+	viper.SetDefault("server.host", "0.0.0.0")
+	viper.SetDefault("server.port", 8080)
+	viper.SetDefault("server.environment", "production")
+	viper.SetDefault("garage.force_path_style", true)
+	viper.SetDefault("logging.level", "info")
+	viper.SetDefault("logging.format", "text")
+
+	// If garage.toml path is provided, parse it and set values as viper
+	// defaults. Defaults sit below config-file and env-var values in viper's
+	// priority order, so YAML and env vars will still win.
+	if lo.garageTomlPath != "" {
+		tomlResult, err := ParseGarageToml(lo.garageTomlPath)
+		if err != nil {
+			return nil, fmt.Errorf("error parsing garage.toml: %w", err)
+		}
+		viper.SetDefault("garage.endpoint", tomlResult.Endpoint)
+		viper.SetDefault("garage.admin_endpoint", tomlResult.AdminEndpoint)
+		viper.SetDefault("garage.admin_token", tomlResult.AdminToken)
+		viper.SetDefault("garage.region", tomlResult.Region)
+	}
+
 	// Allow environment variables to override config values
 	// Environment variables take precedence over config file
 	viper.AutomaticEnv()
@@ -165,6 +214,9 @@ func bindEnvVars() {
 	viper.BindEnv("auth.admin.password", "GARAGE_UI_AUTH_ADMIN_PASSWORD")
 	viper.BindEnv("auth.jwt_private_key", "GARAGE_UI_AUTH_JWT_PRIVATE_KEY")
 
+	// Token auth config
+	viper.BindEnv("auth.token.enabled", "GARAGE_UI_AUTH_TOKEN_ENABLED")
+
 	// OIDC config
 	viper.BindEnv("auth.oidc.enabled", "GARAGE_UI_AUTH_OIDC_ENABLED")
 	viper.BindEnv("auth.oidc.provider_name", "GARAGE_UI_AUTH_OIDC_PROVIDER_NAME")
@@ -250,6 +302,15 @@ func (c *Config) Validate() error {
 	return nil
 }
 
+// ResolveTokenAuth auto-enables token auth when no other auth method is
+// configured, unless it was explicitly set. This ensures the app never
+// starts without a login wall.
+func (c *Config) ResolveTokenAuth() {
+	if !c.Auth.Admin.Enabled && !c.Auth.OIDC.Enabled && !c.Auth.Token.Enabled {
+		c.Auth.Token.Enabled = true
+	}
+}
+
 // GetAddress returns the full server address (host:port)
 func (c *Config) GetAddress() string {
 	return fmt.Sprintf("%s:%d", c.Server.Host, c.Server.Port)

backend/internal/config/config_test.go

@@ -374,6 +374,130 @@ func TestIsDevelopment(t *testing.T) {
 	}
 }
 
+func writeToml(t *testing.T, content string) string {
+	t.Helper()
+	dir := t.TempDir()
+	path := filepath.Join(dir, "garage.toml")
+	if err := os.WriteFile(path, []byte(content), 0600); err != nil {
+		t.Fatalf("write toml: %v", err)
+	}
+	return path
+}
+
+const testGarageToml = `
+[admin]
+api_bind_addr = "[::]:3903"
+admin_token = "toml-token"
+
+[s3_api]
+api_bind_addr = "[::]:3900"
+s3_region = "garage"
+`
+
+func TestLoad_GarageTomlOnly(t *testing.T) {
+	resetViper(t)
+	tomlPath := writeToml(t, testGarageToml)
+	missingYaml := filepath.Join(t.TempDir(), "nope.yaml")
+
+	cfg, err := Load(missingYaml, WithGarageToml(tomlPath))
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.Garage.AdminToken != "toml-token" {
+		t.Errorf("AdminToken = %q, want toml-token", cfg.Garage.AdminToken)
+	}
+	if cfg.Garage.Endpoint != "http://127.0.0.1:3900" {
+		t.Errorf("Endpoint = %q, want http://127.0.0.1:3900", cfg.Garage.Endpoint)
+	}
+	if cfg.Garage.AdminEndpoint != "http://127.0.0.1:3903" {
+		t.Errorf("AdminEndpoint = %q, want http://127.0.0.1:3903", cfg.Garage.AdminEndpoint)
+	}
+	if cfg.Garage.Region != "garage" {
+		t.Errorf("Region = %q, want garage", cfg.Garage.Region)
+	}
+}
+
+func TestLoad_YAMLOverridesToml(t *testing.T) {
+	resetViper(t)
+	tomlPath := writeToml(t, testGarageToml)
+	yaml := `
+server:
+  host: "0.0.0.0"
+  port: 8080
+garage:
+  endpoint: http://custom:3900
+  admin_endpoint: http://custom:3903
+  admin_token: yaml-wins
+`
+	yamlPath := writeConfigFile(t, yaml)
+
+	cfg, err := Load(yamlPath, WithGarageToml(tomlPath))
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.Garage.AdminToken != "yaml-wins" {
+		t.Errorf("AdminToken = %q, want yaml-wins (yaml overrides toml)", cfg.Garage.AdminToken)
+	}
+	if cfg.Garage.Endpoint != "http://custom:3900" {
+		t.Errorf("Endpoint = %q, want http://custom:3900", cfg.Garage.Endpoint)
+	}
+}
+
+func TestLoad_EnvOverridesToml(t *testing.T) {
+	resetViper(t)
+	tomlPath := writeToml(t, testGarageToml)
+	missingYaml := filepath.Join(t.TempDir(), "nope.yaml")
+	t.Setenv("GARAGE_UI_GARAGE_ADMIN_TOKEN", "env-wins")
+
+	cfg, err := Load(missingYaml, WithGarageToml(tomlPath))
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.Garage.AdminToken != "env-wins" {
+		t.Errorf("AdminToken = %q, want env-wins (env overrides toml)", cfg.Garage.AdminToken)
+	}
+}
+
+func TestValidate_TokenAuthAutoEnabled(t *testing.T) {
+	cfg := validBaseConfig()
+	cfg.ResolveTokenAuth()
+	if !cfg.Auth.Token.Enabled {
+		t.Error("expected token auth to be auto-enabled when no other auth is configured")
+	}
+}
+
+func TestValidate_TokenAuthNotAutoEnabledWhenAdminEnabled(t *testing.T) {
+	cfg := validBaseConfig()
+	cfg.Auth.Admin.Enabled = true
+	cfg.Auth.Admin.Username = "u"
+	cfg.Auth.Admin.Password = "p"
+	cfg.ResolveTokenAuth()
+	if cfg.Auth.Token.Enabled {
+		t.Error("expected token auth to stay disabled when admin auth is configured")
+	}
+}
+
+func TestValidate_TokenAuthNotAutoEnabledWhenOIDCEnabled(t *testing.T) {
+	cfg := validBaseConfig()
+	applyValidOIDC(&cfg)
+	cfg.ResolveTokenAuth()
+	if cfg.Auth.Token.Enabled {
+		t.Error("expected token auth to stay disabled when OIDC is configured")
+	}
+}
+
+func TestValidate_TokenAuthExplicitlyEnabled(t *testing.T) {
+	cfg := validBaseConfig()
+	cfg.Auth.Admin.Enabled = true
+	cfg.Auth.Admin.Username = "u"
+	cfg.Auth.Admin.Password = "p"
+	cfg.Auth.Token.Enabled = true
+	cfg.ResolveTokenAuth()
+	if !cfg.Auth.Token.Enabled {
+		t.Error("expected token auth to stay enabled when explicitly set")
+	}
+}
+
 func TestIsProduction(t *testing.T) {
 	tests := []struct {
 		env  string

backend/internal/config/garagetoml.go

@@ -0,0 +1,105 @@
+package config
+
+import (
+	"fmt"
+	"net"
+	"os"
+	"strings"
+
+	toml "github.com/pelletier/go-toml/v2"
+)
+
+// GarageTomlResult holds the values extracted from a garage.toml file.
+type GarageTomlResult struct {
+	Endpoint      string
+	AdminEndpoint string
+	AdminToken    string
+	Region        string
+}
+
+// garageTomlFile represents the subset of garage.toml we care about.
+type garageTomlFile struct {
+	S3API struct {
+		APIBindAddr string `toml:"api_bind_addr"`
+		S3Region    string `toml:"s3_region"`
+	} `toml:"s3_api"`
+	Admin struct {
+		APIBindAddr string `toml:"api_bind_addr"`
+		AdminToken  string `toml:"admin_token"`
+	} `toml:"admin"`
+}
+
+// ParseGarageToml reads a garage.toml file and extracts the values needed
+// for garage-ui configuration.
+func ParseGarageToml(path string) (*GarageTomlResult, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("reading garage.toml: %w", err)
+	}
+
+	var f garageTomlFile
+	if err := toml.Unmarshal(data, &f); err != nil {
+		return nil, fmt.Errorf("parsing garage.toml: %w", err)
+	}
+
+	if f.Admin.AdminToken == "" {
+		return nil, fmt.Errorf("garage.toml: [admin].admin_token is required")
+	}
+	if f.Admin.APIBindAddr == "" {
+		return nil, fmt.Errorf("garage.toml: [admin].api_bind_addr is required")
+	}
+	if f.S3API.APIBindAddr == "" {
+		return nil, fmt.Errorf("garage.toml: [s3_api].api_bind_addr is required")
+	}
+
+	adminEndpoint, err := convertBindAddr(f.Admin.APIBindAddr)
+	if err != nil {
+		return nil, fmt.Errorf("garage.toml: converting admin api_bind_addr: %w", err)
+	}
+
+	s3Endpoint, err := convertBindAddr(f.S3API.APIBindAddr)
+	if err != nil {
+		return nil, fmt.Errorf("garage.toml: converting s3_api api_bind_addr: %w", err)
+	}
+
+	region := f.S3API.S3Region
+	if region == "" {
+		region = "garage"
+	}
+
+	return &GarageTomlResult{
+		Endpoint:      s3Endpoint,
+		AdminEndpoint: adminEndpoint,
+		AdminToken:    f.Admin.AdminToken,
+		Region:        region,
+	}, nil
+}
+
+// convertBindAddr converts a bind address like "[::]:3900" into an HTTP
+// endpoint like "http://127.0.0.1:3900". Wildcard hosts (::, 0.0.0.0, empty)
+// are replaced with 127.0.0.1.
+func convertBindAddr(bindAddr string) (string, error) {
+	if bindAddr == "" {
+		return "", fmt.Errorf("bind address is empty")
+	}
+
+	host, port, err := net.SplitHostPort(bindAddr)
+	if err != nil {
+		return "", fmt.Errorf("invalid bind address %q: %w", bindAddr, err)
+	}
+
+	if port == "" {
+		return "", fmt.Errorf("bind address %q has no port", bindAddr)
+	}
+
+	switch host {
+	case "", "::", "0.0.0.0":
+		host = "127.0.0.1"
+	}
+
+	if strings.Contains(host, ":") {
+		host = "[" + host + "]"
+	}
+
+	return fmt.Sprintf("http://%s:%s", host, port), nil
+}

backend/internal/config/garagetoml_test.go

@@ -0,0 +1,165 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func writeTomlFile(t *testing.T, content string) string {
+	t.Helper()
+	dir := t.TempDir()
+	path := filepath.Join(dir, "garage.toml")
+	if err := os.WriteFile(path, []byte(content), 0600); err != nil {
+		t.Fatalf("write toml: %v", err)
+	}
+	return path
+}
+
+const validGarageToml = `
+metadata_dir = "/var/lib/garage/meta"
+data_dir = "/var/lib/garage/data"
+replication_factor = 1
+
+rpc_bind_addr = "[::]:3901"
+rpc_public_addr = "127.0.0.1:3901"
+rpc_secret = "0000000000000000000000000000000000000000000000000000000000000000"
+
+[s3_api]
+s3_region = "garage"
+api_bind_addr = "[::]:3900"
+root_domain = ".s3.garage"
+
+[s3_web]
+bind_addr = "[::]:3902"
+root_domain = ".web.garage"
+index = "index.html"
+
+[admin]
+api_bind_addr = "[::]:3903"
+admin_token = "my-secret-admin-token"
+`
+
+func TestParseGarageToml_ValidFile(t *testing.T) {
+	path := writeTomlFile(t, validGarageToml)
+	result, err := ParseGarageToml(path)
+	if err != nil {
+		t.Fatalf("ParseGarageToml: %v", err)
+	}
+	if result.AdminToken != "my-secret-admin-token" {
+		t.Errorf("AdminToken = %q, want my-secret-admin-token", result.AdminToken)
+	}
+	if result.AdminEndpoint != "http://127.0.0.1:3903" {
+		t.Errorf("AdminEndpoint = %q, want http://127.0.0.1:3903", result.AdminEndpoint)
+	}
+	if result.Endpoint != "http://127.0.0.1:3900" {
+		t.Errorf("Endpoint = %q, want http://127.0.0.1:3900", result.Endpoint)
+	}
+	if result.Region != "garage" {
+		t.Errorf("Region = %q, want garage", result.Region)
+	}
+}
+
+func TestParseGarageToml_MissingAdminToken(t *testing.T) {
+	toml := `
+[admin]
+api_bind_addr = "[::]:3903"
+[s3_api]
+api_bind_addr = "[::]:3900"
+`
+	path := writeTomlFile(t, toml)
+	_, err := ParseGarageToml(path)
+	if err == nil {
+		t.Fatal("expected error for missing admin_token, got nil")
+	}
+}
+
+func TestParseGarageToml_MissingAdminBindAddr(t *testing.T) {
+	toml := `
+[admin]
+admin_token = "tok"
+[s3_api]
+api_bind_addr = "[::]:3900"
+`
+	path := writeTomlFile(t, toml)
+	_, err := ParseGarageToml(path)
+	if err == nil {
+		t.Fatal("expected error for missing admin api_bind_addr, got nil")
+	}
+}
+
+func TestParseGarageToml_MissingS3BindAddr(t *testing.T) {
+	toml := `
+[admin]
+admin_token = "tok"
+api_bind_addr = "[::]:3903"
+[s3_api]
+s3_region = "garage"
+`
+	path := writeTomlFile(t, toml)
+	_, err := ParseGarageToml(path)
+	if err == nil {
+		t.Fatal("expected error for missing s3_api api_bind_addr, got nil")
+	}
+}
+
+func TestParseGarageToml_DefaultRegion(t *testing.T) {
+	toml := `
+[admin]
+admin_token = "tok"
+api_bind_addr = "[::]:3903"
+[s3_api]
+api_bind_addr = "[::]:3900"
+`
+	path := writeTomlFile(t, toml)
+	result, err := ParseGarageToml(path)
+	if err != nil {
+		t.Fatalf("ParseGarageToml: %v", err)
+	}
+	if result.Region != "garage" {
+		t.Errorf("Region = %q, want garage (default)", result.Region)
+	}
+}
+
+func TestParseGarageToml_FileNotFound(t *testing.T) {
+	_, err := ParseGarageToml("/nonexistent/garage.toml")
+	if err == nil {
+		t.Fatal("expected error for missing file, got nil")
+	}
+}
+
+func TestConvertBindAddr(t *testing.T) {
+	tests := []struct {
+		name     string
+		bindAddr string
+		want     string
+		wantErr  bool
+	}{
+		{"ipv6 wildcard", "[::]:3900", "http://127.0.0.1:3900", false},
+		{"ipv4 wildcard", "0.0.0.0:3900", "http://127.0.0.1:3900", false},
+		{"localhost", "127.0.0.1:3900", "http://127.0.0.1:3900", false},
+		{"specific ipv4", "192.168.1.1:3900", "http://192.168.1.1:3900", false},
+		{"ipv6 localhost", "[::1]:3900", "http://[::1]:3900", false},
+		{"specific ipv6", "[2001:db8::1]:3900", "http://[2001:db8::1]:3900", false},
+		{"empty host", ":3900", "http://127.0.0.1:3900", false},
+		{"empty string", "", "", true},
+		{"no port", "127.0.0.1", "", true},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := convertBindAddr(tc.bindAddr)
+			if tc.wantErr {
+				if err == nil {
+					t.Fatalf("expected error, got %q", got)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if got != tc.want {
+				t.Errorf("convertBindAddr(%q) = %q, want %q", tc.bindAddr, got, tc.want)
+			}
+		})
+	}
+}

backend/internal/handlers/auth.go

@@ -1,6 +1,8 @@
 package handlers
 
 import (
+	"crypto/subtle"
+
 	"Noooste/garage-ui/internal/auth"
 	"Noooste/garage-ui/internal/config"
 	"Noooste/garage-ui/internal/models"
@@ -38,6 +40,9 @@ func (h *AuthHandler) GetAuthConfig(c fiber.Ctx) error {
 		"oidc": fiber.Map{
 			"enabled": h.cfg.Auth.OIDC.Enabled,
 		},
+		"token": fiber.Map{
+			"enabled": h.cfg.Auth.Token.Enabled,
+		},
 	}
 
 	// Add provider name if OIDC is enabled
@@ -108,6 +113,47 @@ func (h *AuthHandler) LoginAdmin(c fiber.Ctx) error {
 	})
 }
 
+// LoginTokenRequest represents the token auth login request
+type LoginTokenRequest struct {
+	Token string `json:"token" validate:"required"`
+}
+
+// LoginToken handles admin token authentication login
+func (h *AuthHandler) LoginToken(c fiber.Ctx) error {
+	var req LoginTokenRequest
+	if err := c.Bind().JSON(&req); err != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Invalid request body"),
+		)
+	}
+
+	// Constant-time comparison to prevent timing attacks
+	if subtle.ConstantTimeCompare([]byte(h.cfg.Garage.AdminToken), []byte(req.Token)) != 1 {
+		return c.Status(fiber.StatusUnauthorized).JSON(
+			models.ErrorResponse(models.ErrCodeUnauthorized, "Invalid admin token"),
+		)
+	}
+
+	userInfo := &auth.UserInfo{
+		Username: "admin-token",
+	}
+
+	sessionToken, err := h.authService.GenerateSessionToken(userInfo)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeInternalError, "Failed to create session"),
+		)
+	}
+
+	return c.JSON(fiber.Map{
+		"success": true,
+		"token":   sessionToken,
+		"user": fiber.Map{
+			"username": userInfo.Username,
+		},
+	})
+}
+
 // GetMe returns the current authenticated user's information
 //
 //	@Summary		Get current user

backend/internal/handlers/auth_test.go

@@ -250,6 +250,139 @@ func TestLoginAdmin_MalformedJSONReturns400(t *testing.T) {
 	}
 }
 
+func TestLoginToken_Success(t *testing.T) {
+	cfg := &config.Config{
+		Garage: config.GarageConfig{
+			AdminToken:    "test-admin-token",
+			Endpoint:      "http://g:3900",
+			AdminEndpoint: "http://g:3903",
+		},
+		Auth: config.AuthConfig{
+			Token: config.TokenAuthConfig{Enabled: true},
+		},
+	}
+	svc := newAuthTestService(t, cfg.Auth.Admin)
+	h := NewAuthHandler(cfg, svc)
+	app := fiber.New()
+	app.Post("/auth/login-token", h.LoginToken)
+
+	body := `{"token":"test-admin-token"}`
+	req := httptest.NewRequest(http.MethodPost, "/auth/login-token", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := app.Test(req)
+	if err != nil {
+		t.Fatalf("app.Test: %v", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		raw, _ := io.ReadAll(resp.Body)
+		t.Fatalf("status = %d, want 200\nbody: %s", resp.StatusCode, raw)
+	}
+
+	var decoded struct {
+		Success bool   `json:"success"`
+		Token   string `json:"token"`
+		User    struct {
+			Username string `json:"username"`
+		} `json:"user"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&decoded); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if !decoded.Success {
+		t.Error("success = false")
+	}
+	if decoded.Token == "" {
+		t.Error("token empty")
+	}
+	if decoded.User.Username != "admin-token" {
+		t.Errorf("username = %q, want admin-token", decoded.User.Username)
+	}
+}
+
+func TestLoginToken_WrongToken(t *testing.T) {
+	cfg := &config.Config{
+		Garage: config.GarageConfig{
+			AdminToken:    "test-admin-token",
+			Endpoint:      "http://g:3900",
+			AdminEndpoint: "http://g:3903",
+		},
+		Auth: config.AuthConfig{
+			Token: config.TokenAuthConfig{Enabled: true},
+		},
+	}
+	svc := newAuthTestService(t, cfg.Auth.Admin)
+	h := NewAuthHandler(cfg, svc)
+	app := fiber.New()
+	app.Post("/auth/login-token", h.LoginToken)
+
+	body := `{"token":"wrong-token"}`
+	req := httptest.NewRequest(http.MethodPost, "/auth/login-token", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := app.Test(req)
+	if err != nil {
+		t.Fatalf("app.Test: %v", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusUnauthorized {
+		t.Fatalf("status = %d, want 401", resp.StatusCode)
+	}
+}
+
+func TestLoginToken_MalformedJSONReturns400(t *testing.T) {
+	cfg := &config.Config{
+		Garage: config.GarageConfig{
+			AdminToken:    "test-admin-token",
+			Endpoint:      "http://g:3900",
+			AdminEndpoint: "http://g:3903",
+		},
+		Auth: config.AuthConfig{
+			Token: config.TokenAuthConfig{Enabled: true},
+		},
+	}
+	svc := newAuthTestService(t, cfg.Auth.Admin)
+	h := NewAuthHandler(cfg, svc)
+	app := fiber.New()
+	app.Post("/auth/login-token", h.LoginToken)
+
+	req := httptest.NewRequest(http.MethodPost, "/auth/login-token", strings.NewReader("{not-json"))
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := app.Test(req)
+	if err != nil {
+		t.Fatalf("app.Test: %v", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400", resp.StatusCode)
+	}
+}
+
+func TestGetAuthConfig_TokenEnabled(t *testing.T) {
+	cfg := &config.Config{
+		Auth: config.AuthConfig{
+			Token: config.TokenAuthConfig{Enabled: true},
+		},
+	}
+	app, _ := newAuthTestApp(t, cfg)
+	req := httptest.NewRequest(http.MethodGet, "/auth/config", nil)
+	resp, err := app.Test(req)
+	if err != nil {
+		t.Fatalf("app.Test: %v", err)
+	}
+	defer resp.Body.Close()
+	var body struct {
+		Token struct {
+			Enabled bool `json:"enabled"`
+		} `json:"token"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if !body.Token.Enabled {
+		t.Error("token.enabled = false, want true")
+	}
+}
+
 func TestGetMe_OIDCUserInfoLocal(t *testing.T) {
 	cfg := &config.Config{Auth: config.AuthConfig{}}
 	app, h := newAuthTestApp(t, cfg)

backend/internal/middleware/auth.go

@@ -1,6 +1,8 @@
 package middleware
 
 import (
+	"strings"
+
 	"Noooste/garage-ui/internal/auth"
 	"Noooste/garage-ui/internal/config"
 	"Noooste/garage-ui/internal/models"
@@ -17,14 +19,14 @@ import (
 func AuthMiddleware(cfg *config.AuthConfig, authService *auth.Service) fiber.Handler {
 	return func(c fiber.Ctx) error {
 		// If no auth is enabled, allow all requests.
-		if !cfg.Admin.Enabled && !cfg.OIDC.Enabled {
+		if !cfg.Admin.Enabled && !cfg.OIDC.Enabled && !cfg.Token.Enabled {
 			return c.Next()
 		}
 
 		authHeader := c.Get("Authorization")
 
-		// Try admin auth if enabled and header is present.
-		if cfg.Admin.Enabled && authHeader != "" {
+		// Try bearer token auth (works for admin, token, or any JWT session)
+		if (cfg.Admin.Enabled || cfg.Token.Enabled) && authHeader != "" {
 			if len(authHeader) > 7 && authHeader[:7] == "Bearer " {
 				token := authHeader[7:]
 				userInfo, err := authService.ValidateSessionToken(token)
@@ -80,14 +82,18 @@ func enrichRequestLogger(c fiber.Ctx, userID, authMethod string) {
 }
 
 func authMethodsEnabled(cfg *config.AuthConfig) string {
-	switch {
-	case cfg.Admin.Enabled && cfg.OIDC.Enabled:
-		return "admin+oidc"
-	case cfg.Admin.Enabled:
-		return "admin"
-	case cfg.OIDC.Enabled:
-		return "oidc"
-	default:
+	methods := []string{}
+	if cfg.Admin.Enabled {
+		methods = append(methods, "admin")
+	}
+	if cfg.OIDC.Enabled {
+		methods = append(methods, "oidc")
+	}
+	if cfg.Token.Enabled {
+		methods = append(methods, "token")
+	}
+	if len(methods) == 0 {
 		return "none"
 	}
+	return strings.Join(methods, "+")
 }

backend/internal/routes/routes.go

@@ -152,8 +152,13 @@ func SetupRoutes(
 		app.Post("/auth/login", authHandler.LoginAdmin)
 	}
 
+	// Token auth login endpoint (only if token auth is enabled)
+	if cfg.Auth.Token.Enabled {
+		app.Post("/auth/login-token", authHandler.LoginToken)
+	}
+
 	// Auth "me" endpoint (if any auth is enabled)
-	if cfg.Auth.Admin.Enabled || cfg.Auth.OIDC.Enabled {
+	if cfg.Auth.Admin.Enabled || cfg.Auth.OIDC.Enabled || cfg.Auth.Token.Enabled {
 		app.Get("/auth/me", middleware.AuthMiddleware(&cfg.Auth, authService), authHandler.GetMe)
 	}