feat: send authDisabled setting in request to disable UI login when True

[nmgaston]

PR Checklist

• Unit Tests have been added for new changes
• API tests have been updated if applicable
• All commented code has been removed
• If you've added a dependency, you've ensured license is compatible with Apache 2.0 and clearly outlined the added dependency.

What are you changing?

This PR makes the server expose whether authentication is disabled, and ensures the UI can fetch that information before login. In practice, it adds an authDisabled flag to the /api/v1/server/features response and moves that endpoint to be publicly accessible.

Anything the reviewer should know when reviewing this PR?

• The main behavior change is in internal/controller/httpapi/v1/server.go, where the response now includes both ciraEnabled and authDisabled.
• internal/controller/httpapi/router.go now registers server routes before auth-protected middleware so /api/v1/server/features is public.
• Tests were added in internal/controller/httpapi/router_test.go and expanded in internal/controller/httpapi/v1/server_test.go.
• The PR also updates OpenAPI-related tests to reflect that GET /api/v1/server/features is now a public endpoint.

If the there are associated PRs in other repositories, please link them here (i.e. device-management-toolkit/repo#365 )

device-management-toolkit/sample-web-ui#3643

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.67%. Comparing base (46b1d54) to head (f0a3d92).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1322      +/-   ##
==========================================
+ Coverage   62.16%   62.67%   +0.50%     
==========================================
  Files         159      159              
  Lines       13401    13403       +2     
==========================================
+ Hits         8331     8400      +69     
+ Misses       5070     5002      -68     
- Partials        0        1       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🟢 Approval recommended

The focused, additive changes align implementation, API documentation, and coverage, with no blocking issues identified in static review; tests were not executed.

0 open findings

What changed in this PR

Exposes the server’s authentication mode before login so the UI can skip login when authentication is disabled.

Changes:

• Adds authDisabled to the server-features response.
• Makes the endpoint public and updates OpenAPI documentation.
• Extends unit, routing, and Postman coverage.

File	Description
internal/​entity/​dto/​v1/​server.go	Adds the authDisabled response field.
internal/​controller/​openapi/​tenant_test.go	Exempts server features from tenant-header requirements.
internal/​controller/​openapi/​server.go	Documents public access and authentication mode.
internal/​controller/​httpapi/​v1/​server.go	Returns the configured authentication mode.
internal/​controller/​httpapi/​v1/​server_test.go	Tests authentication-mode values.
internal/​controller/​httpapi/​router.go	Registers server features outside protected routes.
internal/​controller/​httpapi/​router_test.go	Tests public access while protected routes require authentication.
integration-test/​collections/​console_mps_apis.postman_collection.json	Uses unauthenticated access and validates the new field.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[rsdmike]

Closing this one, since we're going with a build flag instead of an API call for disabling UI auth. Thanks!