milestone 20: declarative configuration for iac

src/web/auth.zig

@@ -58,9 +58,12 @@ pub const cookie_attributes = "HttpOnly; SameSite=Lax; Path=/";
 pub const max_password_len = 256;
 
 /// Authentication is on exactly when a hash exists (ruling 17). An empty hash
-/// is the documented "no password set" state, not a misconfiguration.
+/// is the documented "no password set" state, not a misconfiguration; a null
+/// one means the settings table holds no hash row at all, which is the same
+/// answer.
 pub fn authEnabled(web: model.Web) bool {
-    return web.password_hash.len != 0;
+    const hash = web.password_hash orelse return false;
+    return hash.len != 0;
 }
 
 pub const Outcome = enum {
@@ -453,6 +456,7 @@ fn tokenOf(n: u8) [token_bytes]u8 {
 
 test "authEnabled follows the presence of a hash" {
     try testing.expect(!authEnabled(.{}));
+    try testing.expect(!authEnabled(.{ .password_hash = null }));
     try testing.expect(!authEnabled(.{ .password_hash = "" }));
     try testing.expect(authEnabled(.{ .password_hash = "$argon2id$v=19$m=19456,t=2,p=1$abc$def" }));
 }