chore(api): remove backend auth surface — modules, middleware, tests (Slice A)

[thinmintdev]

Summary

Slice A of the Phase 1 auth removal (PLAN.md v0.3 stream 4). Deletes every auth module, every test that exercises auth, and strips the dependency arrays from every router mount + route decorator. Follows #255 (Slice B, frontend caller already removed), so no production endpoint is left stranded.

−6175 / +88 lines, 36 files.

Why "remove" not "simplify"

The ADR-0001 close-out branches (Child A password auth + Child B Caddy reduction) targeted a softer "simplified password auth + TLS-only Caddy" outcome. The user has elected the harder direction: LAN-trust + no login surface, matching the homelab-appliance posture. The Child A/B branches will be closed as superseded by #254 (Caddy gone), #255 (frontend auth gone), and this PR — no rebase, no historical-record merge.

Deleted source

• src/hal0/api/auth/ (4 files, 712 lines): __init__.py, first_run.py, password.py, rate_limit.py
• src/hal0/auth/ (3 files, 646 lines): __init__.py, passwords.py, tokens.py
• src/hal0/api/middleware/auth.py (508 lines)
• src/hal0/api/routes/auth.py (33 KB)

Deleted tests

• tests/api/test_auth_middleware.py
• tests/api/test_auth_routes.py
• tests/api/test_auth_writer_scope.py
• tests/api/test_firstrun_auth_cookie.py
• tests/api/test_password_auth.py
• tests/api/test_install_routes.py (auth-on / auth-off matrix; the §30 slot-name validation it also pinned lives implicitly in the route's own schema validation now)
• tests/api/test_no_public_paths.py (PUBLIC_PATHS deletion regression — moot once the symbol's parent module is gone)
• tests/auth/ (3 files)
• tests/conftest.py: HAL0_AUTH_DISABLED autouse fixture removed

Stripped from API factory + routes

• src/hal0/api/__init__.py:
  • drop auth + middleware imports
  • drop first-run lockfile mint in lifespan
  • drop auth_rate_limit.install(app)
  • drop the /api/auth router mount
  • drop _v1_auth / _admin_auth dependency arrays
  • drop dependencies= from every include_router call
• 13 route files (config, settings, agents, backends, slots, providers, updater, hardware, installer, models, lemonade_admin, approvals, proxmox):
  • drop from hal0.api.middleware.auth import require_writer
  • drop _writer = [Depends(require_writer)] / _writer_only
  • drop , dependencies=_writer / , dependencies=_writer_only from every decorator
• src/hal0/api/routes/installer.py also drops from hal0.api.auth import first_run as first_run_lock and the post-complete consume_lockfile() call

MCP mount

src/hal0/api/mcp_mount.py:

• drop the from hal0.api.middleware.auth import … block
• inline a tiny _resolve_bearer() helper (parsing the Authorization header is still useful for caller identity)
• MCPAuthMiddleware stops enforcing auth — it now just stashes caller ctx in the contextvar. Comment notes a follow-up to rename → MCPIdentityMiddleware + switch to an explicit X-hal0-Agent identity header per the v0.3 Hermes plan (so Cognee's private:<client_id> namespace still works).

OWUI prewire

src/hal0/openwebui/env_writer.py:

• drop the _auth_enabled() helper + HAL0_AUTH_ENABLED env branching
• OpenWebUI defaults to WEBUI_AUTH=False. Operators who front hal0 with a reverse proxy that injects a trusted email header can pass WEBUI_AUTH=True + the header name via the overrides parameter.

Sequence

Slice	Status	What
B (#255)	merged	frontend useAuth hook + Settings Auth panel
A (this PR)	open	backend auth modules + tests + dependency arrays
C	not started	installer first-run-lock / OTP / password prompt
D	not started	ADR-0011 marking ADR-0001 superseded, docs, CHANGELOG, version bump

Follow-up not in scope (per user briefing, after Slice D lands)

• Update Hermes bootstrap plan + ADR-0011 to drop bearer references and switch to X-hal0-Agent identity header for the Cognee private:<id> namespace source (recommended option 1 from the user's briefing)
• Edit issues Hermes install phase: managed venv + plugin copy + wrapper + secrets #240 / Agent identity cards: ADR-0011 + namespace_register + hal0 agent list #243 / Bootstrap robustness: smoke_tests + self_report + --repair + full CLI surface #246 to drop bearer-token acceptance criteria
• Close ADR-0001 close-out branches (feat/adr-0001-a-password-auth, feat/adr-0001-b-caddy-reduction, docs/adr-0001-c-housekeeping, docs/adr-0001-close-out-2026-05-21) as superseded — handled immediately after this PR opens

Verification

• ruff check src/ clean
• ruff format src/ no diff
• Local pytest collection not run (no pytest in PATH on hal0-dev); CI will catch any import-time errors

Test plan

• CI: python (3.11, 3.12) + ui green
• γ-suite expected to stay red (pre-existing per v3: rewrite apiMock fixture to match new useSlots / useLemonadeHealth hook shape #236)
• After merge: redeploy to hal0 LXC, smoke /, /slots, /hardware, /settings — Settings landing on "Secrets" tab, no auth panel, no JS errors

🤖 Generated with Claude Code