feat(authup)!: writable directory moves to /var/lib/authup, and route.enabled accepts a template - #16

Closes #9. Closes #15.

Two independent fixes, one commit each.

fix(authup): writable directory (#9)

The image default moved from /usr/src/app/writable to /var/lib/authup in v1.0.0-beta.63 (authup/authup#3474). The chart mounted the old path and set no WRITABLE_DIRECTORY_PATH of its own, so the appVersion bump would have pointed server-core at a directory nothing is mounted at. That fails silently: production logs land on the container layer and file provisioning scans a path that does not exist, with nothing in the log to say the directory was not there.

• Mounts move to /var/lib/authup (writable emptyDir, and the provisioning mount under it).
• WRITABLE_DIRECTORY_PATH is now set by the chart to the path it mounts, rather than inherited. That is what keeps a pinned older image.tag working too, so the chart is correct on both sides of the bump.
• server.config.WRITABLE_DIRECTORY_PATH joins the reserved list and fails the render. A duplicate ConfigMap key would have reintroduced the same silent mismatch, so the message names server.extraEnvVars plus a matching server.extraVolumeMounts, which is the only way to move a directory the chart also mounts.

appVersion is bumped to 1.0.0-beta.63 (commit 748b672). The only image-contract change between beta.62 and beta.63 is the writable-directory move this PR follows: entrypoint.sh is unchanged, so the arg dispatch, the forced PORT=3000 and every env name the chart sets still hold. Because the chart pins WRITABLE_DIRECTORY_PATH itself, it also stays correct for anyone who pins image.tag to beta.62 or older (verified against the real beta.62 image: mounting /var/lib/authup, a path that image does not contain, creates it, is writable by the uid the chart runs as, and serves provisioning files from it).

feat(authup): tpl-rendered route.enabled (#15)

Every other field of route was tpl-rendered, but enabled was typed boolean in the schema, so an umbrella could express the whole route through values and still not tie its existence to its own Gateway API switch.

• Schema widened to [boolean, string] for server.route.enabled and adminConsole.route.enabled.
• Read through a new authup.flag helper at all six read sites: both HTTPRoutes, both sub-path catch-all validations, both NOTES warnings. Converting fewer would leave the invariant-18 guard reading the raw value, disarmed for exactly the umbrella users this is for.
• The helper is strict on purpose. The widened schema no longer rejects garbage, and a template rendering to "false" is a non-empty and therefore truthy string, so a plain if would create the route precisely when the parent switched it off. Only true/false (or a template rendering to one) are accepted; anything else fails the render naming the key.

authup:
  server:
    route:
      enabled: '{{ .Values.global.flameHub.gatewayApi.enabled }}'   # now works

Verification

• make test green; make docs schema produces no drift.
• The repo's negative battery still fails all 16 cases, positives still render, and every ci/*-values.yaml renders.
• A throwaway parent chart with authup as a subchart drives both routes from one global.flameHub.gatewayApi.enabled: 2 HTTPRoutes with it on, 0 with it off.
• ci/default-values.yaml carries the false direction as the in-repo regression guard (no install scenario needed, and kind has no Gateway API CRDs).

Migration notes for both are in charts/authup/BREAKING.md.

Summary by CodeRabbit

• New Features
  • Gateway API route settings support boolean values and templated "true"/"false" strings with strict validation.
  • Route rendering, validation, and generated notes consistently honor these settings.
• Breaking Changes
  • Writable application data now uses /var/lib/authup instead of /usr/src/app/writable.
  • Custom writable paths require matching environment and volume mounts; conflicting configuration now fails during rendering.
• Documentation
  • Updated the chart to application version 1.0.0-beta.63.
  • Updated configuration references, migration guidance, and testing documentation for route flags and writable directories.

Versioning

This carries a breaking value change, so the commit is fix(authup)!: with a BREAKING CHANGE: footer and the PR title carries !. Under this repo's squash-merge settings (COMMIT_OR_PR_TITLE + COMMIT_MESSAGES) both the title and the squashed body reach release-please, which should cut the middle digit (0.3.0) rather than a patch.

What breaks for a 0.2.2 user:

• server.config.WRITABLE_DIRECTORY_PATH rendered before and now fails the render (it would otherwise emit a duplicate ConfigMap key and point the server at an unmounted path).
• A server.extraVolumeMounts entry aimed at /usr/src/app/writable no longer overlays the writable directory.

Both are in charts/authup/BREAKING.md.