fix(config): remove default auth.type that broke type inference

The auth type inference logic added in 4a71618 was being bypassed by
the default value auth.type='password' set in loadConfig(). This caused
token-only configurations to fail with 'auth is enabled by default,
configure auth type and secrets backend' because the default forced
password mode, which then required a password_hash.

Remove the default so auth type is properly inferred:
- password_hash configured -> password mode
- only token_secret configured -> token mode

commit: edb08f990589aa59cc2dba2789295ca190f72a69
author: brice · 9mo ago · 2026-01-18 07:33 UTC
parent: 6247cf8
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

1 file · +2 -1

M internal/app/run.go +2 -1


@@ -1281,7 +1281,8 @@ func loadConfig(v *viper.Viper, configPath string) error {
1281	1281		v.SetDefault("logging.container_logs.max_age", 28)
1282	1282		v.SetDefault("env.dir", "") // defaults to {data_dir}/env when empty
1283	1283		v.SetDefault("auth.enabled", true)
1284		-	v.SetDefault("auth.type", "password")
	1284	+	// Note: auth.type is intentionally not set - it's inferred from config
	1285	+	// If password_hash is set -> password mode, otherwise -> token mode
1285	1286		v.SetDefault("auth.secrets_backend", "unsafe")
1286	1287		v.SetDefault("auth.token_expiry", "720h")
1287	1288		v.SetDefault("api.rate_limit.enabled", true)

 	v.SetDefault("logging.container_logs.max_age", 28)
 	v.SetDefault("env.dir", "") // defaults to {data_dir}/env when empty
 	v.SetDefault("auth.enabled", true)
-	v.SetDefault("auth.type", "password")
+	// Note: auth.type is intentionally not set - it's inferred from config
+	// If password_hash is set -> password mode, otherwise -> token mode
 	v.SetDefault("auth.secrets_backend", "unsafe")
 	v.SetDefault("auth.token_expiry", "720h")
 	v.SetDefault("api.rate_limit.enabled", true)