From a80cb8c0605e73962bd68d89ae780ec71f4a471b Mon Sep 17 00:00:00 2001
From: Anish Sarkar <104695310+AnishSarkar22@users.noreply.github.com>
Date: Fri, 26 Jun 2026 18:52:42 +0530
Subject: [PATCH] feat: update authentication defaults to LOCAL

- Changed default AUTH_TYPE in backend configuration to "LOCAL".
- Updated frontend environment configuration to reflect the new default for packaged clients.
- Adjusted runtime authentication resolution to use "LOCAL" as the fallback value.
---
 surfsense_backend/app/config/__init__.py | 2 +-
 surfsense_web/lib/env-config.ts          | 6 +++---
 surfsense_web/lib/runtime-auth-config.ts | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/surfsense_backend/app/config/__init__.py b/surfsense_backend/app/config/__init__.py
index 47e529741..199b9b579 100644
--- a/surfsense_backend/app/config/__init__.py
+++ b/surfsense_backend/app/config/__init__.py
@@ -762,7 +762,7 @@ class Config:
     TURNSTILE_SECRET_KEY = os.getenv("TURNSTILE_SECRET_KEY", "")
 
     # Auth
-    AUTH_TYPE = os.getenv("AUTH_TYPE")
+    AUTH_TYPE = os.getenv("AUTH_TYPE", "LOCAL")
     REGISTRATION_ENABLED = os.getenv("REGISTRATION_ENABLED", "TRUE").upper() == "TRUE"
 
     # Google OAuth
diff --git a/surfsense_web/lib/env-config.ts b/surfsense_web/lib/env-config.ts
index 8c671029c..c60ada372 100644
--- a/surfsense_web/lib/env-config.ts
+++ b/surfsense_web/lib/env-config.ts
@@ -8,9 +8,9 @@
 
 import packageJson from "../package.json";
 
-// Build-time fallback for packaged clients. Docker runtime reads plain AUTH_TYPE
-// through the runtime config provider first, then falls back to this baked value.
-export const BUILD_TIME_AUTH_TYPE = process.env.NEXT_PUBLIC_AUTH_TYPE || "GOOGLE";
+// Build-time fallback for packaged clients. Docker/runtime deployments default to
+// local auth unless AUTH_TYPE/NEXT_PUBLIC_AUTH_TYPE explicitly selects Google.
+export const BUILD_TIME_AUTH_TYPE = process.env.NEXT_PUBLIC_AUTH_TYPE || "LOCAL";
 
 // Backend API URL. An empty string is valid in proxy mode and means
 // same-origin relative requests (e.g. /api/v1/... and /auth/...).
diff --git a/surfsense_web/lib/runtime-auth-config.ts b/surfsense_web/lib/runtime-auth-config.ts
index 9e8d1921d..d619c5957 100644
--- a/surfsense_web/lib/runtime-auth-config.ts
+++ b/surfsense_web/lib/runtime-auth-config.ts
@@ -4,7 +4,7 @@ export type RuntimeAuthUiMode = "GOOGLE" | "LOCAL";
 
 export function resolveRuntimeAuthUiMode(
 	value: string | null | undefined,
-	fallback: string | null | undefined = "GOOGLE"
+	fallback: string | null | undefined = "LOCAL"
 ): RuntimeAuthUiMode {
 	const candidate = value?.trim().toUpperCase();
 	if (candidate === "GOOGLE") return "GOOGLE";