From 64e423953493b6ff0f1d8511db434d7ac64b45f6 Mon Sep 17 00:00:00 2001
From: Bryan Helmkamp <bryan@brynary.com>
Date: Tue, 21 Apr 2026 15:27:19 -0400
Subject: [PATCH] fix(install): don't enable dev-token auth when GitHub App is
 selected

When the install wizard (or `fabro install github --strategy app`)
writes GitHub App settings, it now removes "dev-token" from
`server.auth.methods`, mirroring how `write_token_settings` removes
"github" in the opposite direction. Users who want both auth methods
can still configure that explicitly by editing `settings.toml`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 lib/crates/fabro-cli/src/commands/install.rs |  2 +-
 lib/crates/fabro-install/src/lib.rs          | 17 +++++++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/lib/crates/fabro-cli/src/commands/install.rs b/lib/crates/fabro-cli/src/commands/install.rs
index 808018f4e..29fdf6e96 100644
--- a/lib/crates/fabro-cli/src/commands/install.rs
+++ b/lib/crates/fabro-cli/src/commands/install.rs
@@ -2300,7 +2300,7 @@ client_id = "client-id"
                 .iter()
                 .map(|value| value.as_str().expect("auth method should be a string"))
                 .collect::<Vec<_>>(),
-            vec!["dev-token", "github"]
+            vec!["github"]
         );
 
         let allowed_usernames = doc
diff --git a/lib/crates/fabro-install/src/lib.rs b/lib/crates/fabro-install/src/lib.rs
index e13415561..2e9302f6f 100644
--- a/lib/crates/fabro-install/src/lib.rs
+++ b/lib/crates/fabro-install/src/lib.rs
@@ -215,6 +215,7 @@ pub fn write_github_app_settings(
     if !methods.iter().any(|value| value.as_str() == Some("github")) {
         methods.push(toml::Value::String("github".to_string()));
     }
+    methods.retain(|value| value.as_str() != Some("dev-token"));
     let github_auth = ensure_table(auth, "github")?;
     github_auth.insert(
         "allowed_usernames".to_string(),
@@ -438,6 +439,22 @@ name = "custom"
             github.get("client_id").and_then(toml::Value::as_str),
             Some("client-id")
         );
+
+        let methods = doc
+            .get("server")
+            .and_then(toml::Value::as_table)
+            .and_then(|server| server.get("auth"))
+            .and_then(toml::Value::as_table)
+            .and_then(|auth| auth.get("methods"))
+            .and_then(toml::Value::as_array)
+            .expect("server.auth.methods should exist");
+        assert_eq!(
+            methods
+                .iter()
+                .map(|value| value.as_str().expect("auth method should be a string"))
+                .collect::<Vec<_>>(),
+            vec!["github"]
+        );
     }
 
     #[test]