Rename GRYT_AUTH_MODE to what it actually does (GRYT-281)

[sivert-io]

GRYT_AUTH_MODE read like it controlled whether members need an account. It never did. The entire implementation was:

if (authMode === "disabled")  → reject every join
if (authMode !== "required")  → reject, misconfigured
// otherwise carry on

Joining without an account is decided by GRYT_IDENTITY_TIERS alone, and the two never interacted. A server with GRYT_IDENTITY_TIERS=account,local and GRYT_AUTH_MODE=required admits guests exactly as intended, while the config file next to it claimed the opposite.

It's a maintenance switch wearing a security name. Now it's GRYT_SERVER_ENABLED, taking true/on/yes/1 and false/off/no/0.

The old name still works, silently

A rename that took somebody's server offline on upgrade — or quietly reopened one they'd deliberately closed — would be worse than the bug being fixed. So GRYT_AUTH_MODE and its required/disabled values are still read.

The new variable wins when both are set. That way they can be added and removed in either order without a window where the two disagree and the answer depends on which the code happened to read first.

Two decisions worth checking

An unrecognised value still refuses joins, as the old code did. Neither default is safe: reading requried as on ignores somebody who meant to close their server; reading it as off takes a server down over a typo. The error names whichever variable the operator actually set, so it points at the line they wrote rather than the one we prefer.

An empty value is treated as unset, not as a refusal. A commented-out line leaving GRYT_SERVER_ENABLED= behind shouldn't take a server down. Tested.

Kept the auth_disabled error code and its wording, even though "disabled authentication" is now doubly wrong. The client matches on the code, and changing the code and the copy in the same release would leave nothing recognisable in a bug report. Worth doing later, separately.

Verified

yarn test — 82 pass, 0 fail. 19 new, covering both variables, all accepted spellings, precedence when both are set, the empty-value case, and that a typo refuses rather than guessing.

Not in this PR

The docs still describe the old behaviour, and in one place give actively wrong advice — configuration.mdx:389 says "Use GRYT_AUTH_MODE=required if you need account-based access control", which does nothing of the sort. Four docs pages plus two .env.example files need updating; those are separate repos and separate PRs. The .env.example under ops/deploy/compose is already being fixed in gryt#80.

🤖 Generated with Claude Code