From 83a50844c5c9cac0ffcb20d62fe73515ae98b75a Mon Sep 17 00:00:00 2001
From: rock <locartrock@gmail.com>
Date: Tue, 8 Sep 2026 15:51:15 +0000
Subject: [PATCH] feat: disable auth for testing + config refactor (#44)

Co-authored-by: rock <locartrock@gmail.com>
---
 .gitea/workflows/build.yaml       |  2 +-
 crates/mem-cli/src/http_server.rs | 19 ++++++++++++++++++-
 k8s/app/config.yaml               |  2 +-
 3 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index 0f1e31c..8b03daa 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -9,7 +9,7 @@ on:
 
 env:
   REGISTRY: forgejo.riotpiao.com
-  IMAGE: forgejo.riotpiao.com/rock/poimen-memory
+  IMAGE: forgejo.riotpiao.com/riotpiao-poimen/poimen-memory
   DOCKER_HOST: tcp://localhost:2375
   SQLX_OFFLINE: "true"
 
diff --git a/crates/mem-cli/src/http_server.rs b/crates/mem-cli/src/http_server.rs
index bcaf31b..2aee93d 100644
--- a/crates/mem-cli/src/http_server.rs
+++ b/crates/mem-cli/src/http_server.rs
@@ -50,13 +50,29 @@ pub struct AppState {
 pub enum AuthMode {
     Jwt,      // Validate JWT from Authentik
     ApiKey,   // Fallback to static API key
+    None,     // No auth (testing only)
 }
 
-/// Auth extractor — validates JWT or fallback to apikey
+/// Auth extractor — validates JWT, apikey, or disabled
 async fn validate_auth(req: &HttpRequest, state: &AppState) -> Result<(JwtClaims, String), HttpResponse> {
     match state.auth_mode {
         AuthMode::Jwt => validate_jwt_token(req, state).await,
         AuthMode::ApiKey => validate_apikey(req, state),
+        AuthMode::None => {
+            tracing::warn!("Auth disabled - returning synthetic claims");
+            let claims = JwtClaims {
+                sub: "test-user".to_string(),
+                iss: "test".to_string(),
+                aud: "memory".to_string(),
+                exp: i64::MAX,
+                iat: chrono::Utc::now().timestamp(),
+                nbf: None,
+                permissions: Some(vec!["memory:write".to_string(), "memory:read".to_string()]),
+                groups: Some(vec!["test".to_string()]),
+                roles: None,
+            };
+            Ok((claims, "synthetic-token".to_string()))
+        }
     }
 }
 
@@ -256,6 +272,7 @@ pub async fn start_server(port: u16, api_key: String, database_url: &str) -> Res
     let auth_mode = match auth_mode.as_str() {
         "jwt" => AuthMode::Jwt,
         "apikey" => AuthMode::ApiKey,
+        "none" => AuthMode::None,
         _ => {
             tracing::warn!("Unknown auth mode: {}, defaulting to apikey", auth_mode);
             AuthMode::ApiKey
diff --git a/k8s/app/config.yaml b/k8s/app/config.yaml
index 8dd8cfb..fb9539c 100644
--- a/k8s/app/config.yaml
+++ b/k8s/app/config.yaml
@@ -10,7 +10,7 @@ metadata:
     app.kubernetes.io/component: config
 data:
   # Auth mode: jwt | apikey
-  MEM_AUTH_MODE: "jwt"
+  MEM_AUTH_MODE: "none"
   # Rate limiting
   MEM_RATE_LIMIT_INGEST: "100"
   MEM_RATE_LIMIT_QUERY: "1000"