refactor(config)!: derive enable_login_flow from mode, remove ENABLE_LOGIN_FLOW env var
Once OAUTH_SINGLE_AUDIENCE was renamed to LOGIN_FLOW and the validation
gate ensured the only meaningful configuration was
`MCP_DEPLOYMENT_MODE=login_flow + ENABLE_LOGIN_FLOW=true`, the two
controls became redundant. Setting the mode is sufficient; the
ENABLE_LOGIN_FLOW env var doesn't add information.
This commit makes the deployment mode the single source of truth for
the Login Flow v2 toggle:
- `nextcloud_mcp_server/config.py`: drop the `ENABLE_LOGIN_FLOW`
dynaconf env-var alias. The `enable_login_flow` field stays as an
internal attribute so the 6 runtime call sites (app.py x4,
context.py, auth/scope_authorization.py) keep working unchanged.
Updated field docstring to flag it as derived.
- `nextcloud_mcp_server/config_validators.py`:
- Drop `enable_login_flow` from `MODE_REQUIREMENTS[LOGIN_FLOW].required`.
- Drop the validation gate that required ENABLE_LOGIN_FLOW=true for
LOGIN_FLOW mode (no longer possible to misconfigure — the flag is
derived, not user input).
- Add `_sync_derived_flags()` helper called at every return path of
`detect_auth_mode` to set `settings.enable_login_flow` from the
resolved mode.
- `tests/unit/test_config_validators.py`: drop `enable_login_flow=True`
from happy-path fixtures (no longer needed — detection sets it).
Repurpose `test_login_flow_requires_enable_login_flow_flag` into
`test_login_flow_mode_auto_derives_enable_login_flow_flag` which
asserts the new auto-derivation behaviour for both LOGIN_FLOW and a
non-LOGIN_FLOW mode.
- `docker-compose.yml`: remove `ENABLE_LOGIN_FLOW=true` from the
`mcp-login-flow` and `mcp-keycloak` profiles.
- `env.sample`: remove the ENABLE_LOGIN_FLOW reference; the comment
on `MCP_DEPLOYMENT_MODE` now notes the derived flag.
- `docs/configuration.md`, `docs/authentication.md`,
`docs/login-flow-v2.md`, `docs/auth-flows.md`,
`docs/troubleshooting.md`, `docs/ADR-025-*.md`: replace
ENABLE_LOGIN_FLOW=true examples and references with
MCP_DEPLOYMENT_MODE=login_flow.
BREAKING CHANGE: `ENABLE_LOGIN_FLOW` is no longer read from the
environment. Anyone who relied on `ENABLE_LOGIN_FLOW=true` to activate
Login Flow v2 should set `MCP_DEPLOYMENT_MODE=login_flow` instead (or
rely on it being the default when no other auth env vars are set).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Chris Coutinho
co-authored by
Claude Opus 4.7
Claude Opus 4.7
parent
c74ef014ee
commit
df4994e860
@@ -289,22 +289,22 @@ class TestLoginFlowValidation:
|
||||
"""Test validation for Login Flow v2 mode (formerly OAUTH_SINGLE_AUDIENCE)."""
|
||||
|
||||
def test_valid_minimal_config(self):
|
||||
"""Test valid minimal Login Flow v2 config."""
|
||||
"""Test valid minimal Login Flow v2 config — enable_login_flow is now derived."""
|
||||
settings = Settings(
|
||||
nextcloud_host="http://localhost",
|
||||
enable_login_flow=True,
|
||||
)
|
||||
|
||||
mode, errors = validate_configuration(settings)
|
||||
|
||||
assert mode == AuthMode.LOGIN_FLOW
|
||||
assert len(errors) == 0
|
||||
# ADR-022 follow-up: enable_login_flow is derived from the resolved mode.
|
||||
assert settings.enable_login_flow is True
|
||||
|
||||
def test_valid_with_static_credentials(self):
|
||||
"""Test valid config with static OAuth credentials."""
|
||||
settings = Settings(
|
||||
nextcloud_host="http://localhost",
|
||||
enable_login_flow=True,
|
||||
oidc_client_id="test-client",
|
||||
oidc_client_secret="test-secret",
|
||||
)
|
||||
@@ -318,7 +318,6 @@ class TestLoginFlowValidation:
|
||||
"""Test valid config with offline access."""
|
||||
settings = Settings(
|
||||
nextcloud_host="http://localhost",
|
||||
enable_login_flow=True,
|
||||
oidc_client_id="test-client",
|
||||
oidc_client_secret="test-secret",
|
||||
enable_offline_access=True,
|
||||
@@ -348,7 +347,6 @@ class TestLoginFlowValidation:
|
||||
"""Test error when offline access enabled but encryption key missing."""
|
||||
settings = Settings(
|
||||
nextcloud_host="http://localhost",
|
||||
enable_login_flow=True,
|
||||
enable_offline_access=True,
|
||||
token_storage_db="/tmp/tokens.db",
|
||||
)
|
||||
@@ -358,19 +356,28 @@ class TestLoginFlowValidation:
|
||||
assert mode == AuthMode.LOGIN_FLOW
|
||||
assert any("token_encryption_key" in err.lower() for err in errors)
|
||||
|
||||
def test_login_flow_requires_enable_login_flow_flag(self):
|
||||
"""ADR-022: LOGIN_FLOW mode must error when ENABLE_LOGIN_FLOW is not true."""
|
||||
settings = Settings(
|
||||
nextcloud_host="http://localhost",
|
||||
# enable_login_flow deliberately omitted (defaults to False)
|
||||
)
|
||||
|
||||
mode, errors = validate_configuration(settings)
|
||||
def test_login_flow_mode_auto_derives_enable_login_flow_flag(self):
|
||||
"""ADR-022 follow-up: setting MCP_DEPLOYMENT_MODE=login_flow auto-derives the flag.
|
||||
|
||||
Users no longer need to set ENABLE_LOGIN_FLOW=true (env var was removed);
|
||||
detect_auth_mode populates settings.enable_login_flow from the resolved mode.
|
||||
"""
|
||||
# Default-fallback case: no auth env vars → LOGIN_FLOW.
|
||||
settings = Settings(nextcloud_host="http://localhost")
|
||||
assert settings.enable_login_flow is False # default before detection
|
||||
mode = detect_auth_mode(settings)
|
||||
assert mode == AuthMode.LOGIN_FLOW
|
||||
assert any("ENABLE_LOGIN_FLOW" in err for err in errors), (
|
||||
f"Expected ENABLE_LOGIN_FLOW gate error, got: {errors}"
|
||||
assert settings.enable_login_flow is True
|
||||
|
||||
# Non-LOGIN_FLOW mode should leave the flag False.
|
||||
basic_settings = Settings(
|
||||
nextcloud_host="http://localhost",
|
||||
nextcloud_username="alice",
|
||||
nextcloud_password="hunter2",
|
||||
)
|
||||
basic_mode = detect_auth_mode(basic_settings)
|
||||
assert basic_mode == AuthMode.SINGLE_USER_BASIC
|
||||
assert basic_settings.enable_login_flow is False
|
||||
|
||||
def test_vector_sync_auto_enables_background_ops_in_login_flow_mode(self):
|
||||
"""Test vector sync automatically enables background operations in Login Flow v2 mode (ADR-021)."""
|
||||
@@ -380,7 +387,6 @@ class TestLoginFlowValidation:
|
||||
os.environ,
|
||||
{
|
||||
"NEXTCLOUD_HOST": "http://localhost:8080",
|
||||
"ENABLE_LOGIN_FLOW": "true",
|
||||
"VECTOR_SYNC_ENABLED": "true",
|
||||
"QDRANT_LOCATION": ":memory:",
|
||||
"OLLAMA_BASE_URL": "http://ollama:11434",
|
||||
|
||||
Reference in New Issue
Block a user