v0.34.15

src/config/model.rs

@@ -70,8 +70,6 @@ pub struct Config {
     pub vhosts: Vec<crate::vhost::Vhost>,
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub host_policies: Vec<HostPolicy>,
-    // Preserve old 0.34.13 and earlier config/backup data until compilation migrates it.
-    // Migration happens in compile_with_active, before validation and persistence.
     #[serde(
         default,
         rename = "user_agent_blocking",
@@ -85,12 +83,9 @@ pub struct Config {
     #[serde(default, skip_serializing_if = "HeaderRules::is_empty")]
     pub headers: HeaderRules,
 }
-/// Global HTTP public-listener security. Disabled defaults preserve older configurations.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(default, deny_unknown_fields)]
 pub struct GlobalSecurity {
-    // None distinguishes omitted legacy input from an explicitly configured empty policy.
-    // Successful compilation always normalizes this to Some(...).
     pub user_agent_blocking: Option<crate::user_agent::Policy>,
     pub country_access: crate::rate_limit::CountryAccess,
     pub acl: Option<Acl>,
@@ -308,7 +303,7 @@ pub struct CompiledFrontend {
     pub metrics: Arc<crate::metrics::VhostMetrics>,
     pub server_header: crate::settings::ServerHeader,
     pub diagnostic_headers: crate::settings::DiagnosticHeaders,
-    pub tinyauth: Option<crate::tinyauth::Compiled>,
+    pub auth_provider: Option<crate::auth_provider::Compiled>,
     pub id: String,
     pub bindings: Vec<crate::vhost::Listener>,
     pub acl_profile_id: Option<String>,

src/config/routing.rs

@@ -216,7 +216,13 @@ fn compile_routing(
                 .diagnostic_headers
                 .clone()
                 .unwrap_or_else(|| config.diagnostic_headers.clone()),
-            tinyauth: host.tinyauth.compile(&desired_policy, &guarded_bindings)?,
+            auth_provider: crate::auth_provider::Selection {
+                basic_enabled: host.basic_auth.enabled,
+                tinyauth: &host.tinyauth,
+                authelia: &host.authelia,
+                authentik: &host.authentik,
+            }
+            .compile(&desired_policy, &guarded_bindings)?,
             id: host.id.clone(),
             bindings: host_bindings,
             acl_profile_id: host.acl_profile_id.clone(),

src/config/tests.rs

@@ -28,6 +28,43 @@ mod tests {
             .is_none());
     }
 
+    #[test]
+    fn optional_forward_auth_providers_preserve_legacy_vhost_configuration() {
+        let config = demo_config("127.0.0.1:9000".parse().unwrap());
+        let encoded = serde_json::to_value(&config.vhosts[0]).unwrap();
+        let mut legacy = encoded.as_object().unwrap().clone();
+        legacy.remove("authelia");
+        legacy.remove("authentik");
+        let restored: crate::vhost::Vhost = serde_json::from_value(legacy.into()).unwrap();
+        assert!(!restored.authelia.enabled);
+        assert!(!restored.authentik.enabled);
+    }
+
+    #[test]
+    fn forward_auth_selection_must_be_mutually_exclusive() {
+        for (left, right) in [
+            ("tinyauth", "authelia"),
+            ("authelia", "authentik"),
+            ("authentik", "basic"),
+        ] {
+            let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
+            let host = &mut config.vhosts[0];
+            for enabled in [left, right] {
+                match enabled {
+                    "tinyauth" => host.tinyauth.enabled = true,
+                    "authelia" => host.authelia.enabled = true,
+                    "authentik" => host.authentik.enabled = true,
+                    "basic" => host.basic_auth.enabled = true,
+                    _ => unreachable!(),
+                }
+            }
+            assert!(
+                host.validate().is_err(),
+                "combination {left} and {right} must be refused"
+            );
+        }
+    }
+
     #[test]
     fn missing_http2_settings_use_release_defaults() {
         let config: Config = serde_json::from_value(serde_json::json!({})).unwrap();