Bryan Helmkamp d8fce8efe0 refactor(settings): stage 6.6g rewrite auth resolver for v2 ... Replaces the `build_legacy_api_settings` + `resolve_auth_mode_with_lookup(&ApiSettings, &[String], lookup)` shim path with a direct `resolve_auth_mode_with_lookup(&SettingsFile, lookup)` that walks the v2 `server.auth.api.{jwt,mtls}` and `server.auth.web.allowed_usernames` subtrees directly: - Each strategy subtree is considered enabled when present unless `enabled = false` is explicit (R52). - `allowed_usernames` is read from `server.auth.web.allowed_usernames` instead of a separate caller-supplied `&[String]` slice. - The FABRO_LOCAL_NO_AUTH escape hatch and "no strategies configured; rejecting everything" warnings are preserved. Deletes the `ApiAuthStrategy` and `ApiSettings` transitional shim types from `fabro-server/src/jwt_auth.rs`. `TlsSettings` survives (it's the resolved `(cert, key, ca)` triple that `tls.rs`'s rustls builder still consumes), with a new `TlsSettings::from_settings(&SettingsFile)` constructor that projects `server.listen.tls` into the runtime shape. `serve.rs` drops its `build_legacy_api_settings` helper entirely (~60 LOC). The serve bootstrap now calls `resolve_auth_mode_with_lookup(&cfg_file, ...)` directly and uses `TlsSettings::from_settings(&cfg_file)` for the TCP-vs-Unix branch. The `build_legacy_api_settings` TODO-2 from handoff-2 is resolved. TlsSettings uses `is_some_and` instead of `map_or(false, ...)` to satisfy the clippy `unnecessary_map_or` lint. All 3,758 workspace tests pass. `cargo fmt --check --all` and `cargo clippy --workspace -- -D warnings` are clean. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>		2026-04-09 18:38:22 -04:00
..
crates	refactor(settings): stage 6.6g rewrite auth resolver for v2	2026-04-09 18:38:22 -04:00
packages/fabro-api-client	refactor(api): stage 6.6 collapse settings DTOs to freeform v2 shape	2026-04-09 17:04:33 -04:00