From f9ec4cc986d0f3362f73a99ebc8184bde40593e8 Mon Sep 17 00:00:00 2001 From: librelad Date: Tue, 18 Aug 2026 23:13:53 +0100 Subject: [PATCH] refactor(auth): drop the unread AUTH_PROFILE key MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Eleven app configs declared CFG__AUTH_PROFILE as a "capability tier for the WebUI auth tools". Nothing read it — not a shell script, not the frontend, and it was never emitted into apps.json, so the WebUI could not have acted on it even in principle. The job it was meant to do is already done, and done better: authAdapterCanDo tests `declare -F authAdapter__`, so what an app can do is derived from the functions it actually implements. A declared tier is a second source of truth that can only drift — traefik declared single_password while its adapter implements setPassword only, and linkding declared nothing at all while shipping a full multi-user adapter, and neither mismatch had any effect. Removed the key and its comment from all eleven configs, and replaced the stale contract note in auth_adapter.sh with what the dispatcher really does. Co-Authored-By: Claude Opus 5 --- containers/adguard/adguard.config | 2 -- containers/bookstack/bookstack.config | 2 -- containers/gitea/gitea.config | 2 -- containers/invidious/invidious.config | 2 -- containers/matrix/matrix.config | 2 -- containers/mattermost/mattermost.config | 2 -- containers/nextcloud/nextcloud.config | 1 - containers/rocketchat/rocketchat.config | 2 -- containers/stalwart/stalwart.config | 2 -- containers/stoat/stoat.config | 2 -- containers/traefik/traefik.config | 2 -- scripts/app/auth_adapter.sh | 11 +++++++---- 12 files changed, 7 insertions(+), 25 deletions(-) diff --git a/containers/adguard/adguard.config b/containers/adguard/adguard.config index 5f284ef..8665b78 100755 --- a/containers/adguard/adguard.config +++ b/containers/adguard/adguard.config @@ -74,7 +74,5 @@ CFG_ADGUARD_PORT_5="adguard-service|dot|random:853|disabled|tcp|false|false|fals CFG_ADGUARD_PORT_6="adguard-exporter|metrics|9617:9617|disabled|tcp|false|false|false|Metrics Exporter (sidecar, docker-network only)|" -# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user) -CFG_ADGUARD_AUTH_PROFILE=single_password CFG_ADGUARD_ADMIN_USER= CFG_ADGUARD_ADMIN_PASSWORD_1=RANDOMIZEDPASSWORD2 diff --git a/containers/bookstack/bookstack.config b/containers/bookstack/bookstack.config index 4cc7fa7..09f9ad8 100644 --- a/containers/bookstack/bookstack.config +++ b/containers/bookstack/bookstack.config @@ -77,6 +77,4 @@ CFG_BOOKSTACK_NETWORK=default # CFG_BOOKSTACK_PORT_1="bookstack-service|webui|random:80|public|tcp|false|true|true|Web Interface||bookstack" -# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user) -CFG_BOOKSTACK_AUTH_PROFILE=multi_user CFG_BOOKSTACK_ADMIN_USER= diff --git a/containers/gitea/gitea.config b/containers/gitea/gitea.config index 572661d..8663099 100755 --- a/containers/gitea/gitea.config +++ b/containers/gitea/gitea.config @@ -67,8 +67,6 @@ CFG_GITEA_NETWORK=default CFG_GITEA_PORT_1="gitea-service|webui|random:3000|public|tcp|false|true|true|Web Interface||gitea" CFG_GITEA_PORT_2="gitea-service|ssh|random:22|private|tcp|false|false|false|Git SSH Access|" -# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user) -CFG_GITEA_AUTH_PROFILE=multi_user CFG_GITEA_ADMIN_USER= CFG_GITEA_ADMIN_EMAIL= # diff --git a/containers/invidious/invidious.config b/containers/invidious/invidious.config index 4285177..152f2c4 100755 --- a/containers/invidious/invidious.config +++ b/containers/invidious/invidious.config @@ -65,8 +65,6 @@ CFG_INVIDIOUS_NETWORK=default # CFG_INVIDIOUS_PORT_1="invidious-service|webui|random:3000|public|tcp|false|true|true|Web Interface||invidious" -# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user) -CFG_INVIDIOUS_AUTH_PROFILE=multi_user CFG_INVIDIOUS_ADMIN_USER= CFG_INVIDIOUS_ADMIN_EMAIL= # diff --git a/containers/matrix/matrix.config b/containers/matrix/matrix.config index 4f34eaa..4ca0929 100644 --- a/containers/matrix/matrix.config +++ b/containers/matrix/matrix.config @@ -115,5 +115,3 @@ CFG_MATRIX_NETWORK=default CFG_MATRIX_PORT_1="matrix-synapse|homeserver|random:8008|public|tcp|false|true|false|Matrix Homeserver (client + federation API)||matrix" CFG_MATRIX_PORT_2="matrix-element|webui|random:80|public|tcp|false|true|true|Element Web Interface||element" -# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user) -CFG_MATRIX_AUTH_PROFILE=multi_user diff --git a/containers/mattermost/mattermost.config b/containers/mattermost/mattermost.config index bc863dc..f401351 100644 --- a/containers/mattermost/mattermost.config +++ b/containers/mattermost/mattermost.config @@ -75,8 +75,6 @@ CFG_MATTERMOST_NETWORK=default # CFG_MATTERMOST_PORT_1="mattermost-service|webui|random:8065|public|tcp|false|true|true|Web Interface||mattermost" -# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user) -CFG_MATTERMOST_AUTH_PROFILE=multi_user # Email of the account the WebUI card advertises; set by whoever runs the setup # wizard or the create-account tool, and kept in step by the reset-password tool. CFG_MATTERMOST_ADMIN_EMAIL= diff --git a/containers/nextcloud/nextcloud.config b/containers/nextcloud/nextcloud.config index 120ae08..a7c85c5 100755 --- a/containers/nextcloud/nextcloud.config +++ b/containers/nextcloud/nextcloud.config @@ -29,7 +29,6 @@ CFG_NEXTCLOUD_DB_NAME=nextcloud CFG_NEXTCLOUD_DB_USER=nextcloud CFG_NEXTCLOUD_DB_PASSWORD_1=RANDOMIZEDPASSWORD2 CFG_NEXTCLOUD_DB_ROOT_PASSWORD_1=RANDOMIZEDPASSWORD3 -CFG_NEXTCLOUD_AUTH_PROFILE=multi_user # # ============================================================================= # METADATA diff --git a/containers/rocketchat/rocketchat.config b/containers/rocketchat/rocketchat.config index 9cb6673..8a8d885 100644 --- a/containers/rocketchat/rocketchat.config +++ b/containers/rocketchat/rocketchat.config @@ -76,5 +76,3 @@ CFG_ROCKETCHAT_NETWORK=default # CFG_ROCKETCHAT_PORT_1="rocketchat-service|webui|random:3000|public|tcp|false|true|true|Web Interface||rocketchat" -# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user) -CFG_ROCKETCHAT_AUTH_PROFILE=multi_user diff --git a/containers/stalwart/stalwart.config b/containers/stalwart/stalwart.config index 14478a6..794809e 100644 --- a/containers/stalwart/stalwart.config +++ b/containers/stalwart/stalwart.config @@ -117,12 +117,10 @@ CFG_STALWART_PORT_7="stalwart-service|pop3s|995:995|disabled|tcp|false|false|fal CFG_STALWART_PORT_8="stalwart-service|sieve|4190:4190|disabled|tcp|false|false|false|ManageSieve (client-managed mail filters)|" CFG_STALWART_PORT_9="stalwart-service|jmap|443:443|disabled|tcp|false|false|false|HTTPS/JMAP direct — leave disabled when Traefik fronts the UI|" -# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user) # The password reaches the container through a compose environment variable, so # if you replace the generated one by hand keep it alphanumeric: docker compose # interpolates `$` and YAML treats ` #` as a comment, either of which would # silently mangle the value. The generator only emits letters and digits. -CFG_STALWART_AUTH_PROFILE=user_password CFG_STALWART_ADMIN_USER=admin CFG_STALWART_ADMIN_PASSWORD_1=RANDOMIZEDPASSWORD1 # diff --git a/containers/stoat/stoat.config b/containers/stoat/stoat.config index c3fe048..3082eb5 100644 --- a/containers/stoat/stoat.config +++ b/containers/stoat/stoat.config @@ -95,7 +95,5 @@ CFG_STOAT_PORT_1="stoat-caddy|webui|random:80|public|tcp|false|true|true|Web Int # Not Traefik-managed — WebRTC is not HTTP. CFG_STOAT_PORT_2="stoat-livekit|voice-tcp|7881:7881|public|tcp|false|false|false|LiveKit voice/video (TCP fallback)|" -# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user) # Stoat exposes no safe way to set a password or grant a role from outside the # app, so these tools list and enable/disable only — see scripts/stoat_auth.sh. -CFG_STOAT_AUTH_PROFILE=multi_user diff --git a/containers/traefik/traefik.config b/containers/traefik/traefik.config index 03b4c36..62b1922 100755 --- a/containers/traefik/traefik.config +++ b/containers/traefik/traefik.config @@ -85,6 +85,4 @@ CFG_TRAEFIK_PORT_1="traefik-service|dashboard|random:8080|public|tcp|true|true|t CFG_TRAEFIK_PORT_2="traefik-service|https|443:443|public|tcp|false|false|false|HTTPS Traffic|" CFG_TRAEFIK_PORT_3="traefik-service|http|80:80|disabled|tcp|false|false|false|HTTP Traffic|" -# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user) -CFG_TRAEFIK_AUTH_PROFILE=single_password CFG_TRAEFIK_ADMIN_USER= diff --git a/scripts/app/auth_adapter.sh b/scripts/app/auth_adapter.sh index d1214b0..bcba8b7 100644 --- a/scripts/app/auth_adapter.sh +++ b/scripts/app/auth_adapter.sh @@ -2,14 +2,17 @@ # Universal user/credential adapter for app tools. # -# Each app declares an auth profile in its config: -# CFG__AUTH_PROFILE = single_password | user_password | multi_user | none -# -# And implements adapter functions in containers//scripts/_auth.sh: +# An app opts in by implementing adapter functions in +# containers//scripts/_auth.sh: # authAdapter__setPassword "$user" "$password" # authAdapter__createUser "$user" "$password" "$email" "$isAdmin" # authAdapter__listUsers # +# What an app can do is discovered from which of those exist (authAdapterCanDo), +# not declared anywhere. There used to be a CFG__AUTH_PROFILE key naming a +# capability tier, but nothing ever read it — it was a second source of truth +# that could only drift out of step with the functions actually implemented. +# # Tool wrappers call authAdapterCall . The # dispatcher checks the function exists, runs it, and refreshes apps.json # via webuiPatchAppConfigJson so new admin creds surface in the WebUI.