s

common/config.go

@@ -32,8 +32,8 @@ func (c *Config) RepoRoot() string {
 // Prepare checks that the config is valid and creates the repo root if needed.
 func (c *Config) Prepare() error {
 	var err error
-	if c.DBUri == "" && c.SkipAuth == false {
+	if c.DBUri == "" {
-		return errors.New("simplegit: -db is required unless -skip-auth (e.g. sqlite://state.db)")
+		return errors.New("simplegit: -db is required (e.g. sqlite://state.db)")
 	}
 	if err := os.MkdirAll(c.RepoRoot(), 0o755); err != nil {
 		return fmt.Errorf("simplegit: Failed to create data root: %s (%v)", c.RepoRoot(), err)

state/db.go

@@ -78,9 +78,6 @@ var (
 type LocalState struct {
 	engine *xorm.Engine
 	cfg    *common.Config
-	// skipAuth bypasses the DB: AccessBy* always allow, RepoPath resolves any
-	// path under root. engine is nil in this mode.
-	skipAuth bool
 
 	signerMu   sync.Mutex
 	signers    []ssh.Signer
@@ -219,10 +216,8 @@ func (s *LocalState) findRepo(owner, name string) (*Repo, error) {
 func (s *LocalState) RepoPath(owner, name string) (string, error) {
 	name = normalizeName(name)
 	rel := relPath(owner, name)
-	if !s.skipAuth {
+	if _, err := s.findRepo(owner, name); err != nil {
-		if _, err := s.findRepo(owner, name); err != nil {
+		return "", err
-			return "", err
-		}
 	}
 	return common.Resolve(s.cfg.RepoRoot(), rel)
 }

state/http.go

@@ -35,9 +35,6 @@ const patPrefix = "sgp_" // plaintext token prefix
 //
 // skip-auth allows all.
 func (s *LocalState) AccessByPAT(ctx context.Context, pat, owner, name string, perm common.Perm) (bool, error) {
-	if s.skipAuth {
-		return true, nil
-	}
 	r, err := s.findRepo(owner, name)
 	if err != nil {
 		if errors.Is(err, ErrRepoNotFound) {

state/mut.go

@@ -115,23 +115,20 @@ func (s *LocalState) CreateRepo(ns, name string) error {
 	}
 
 	var nsID, nameID int64
-	if !s.skipAuth {
+	nsID, err = s.resolveNamespaceID(ns)
-		nsID, err = s.resolveNamespaceID(ns)
+	if err != nil {
-		if err != nil {
+		if !errors.Is(err, ErrNamespaceNotFound) {
-			if !errors.Is(err, ErrNamespaceNotFound) {
+			return err
-				return err
-			}
-			nsID, err = s.nextNamespaceID() // brand-new namespace
-			if err != nil {
-				return err
-			}
 		}
-		nameID, err = s.nextNameID()
+		nsID, err = s.nextNamespaceID() // brand-new namespace
 		if err != nil {
 			return err
 		}
 	}
-
+	nameID, err = s.nextNameID()
+	if err != nil {
+		return err
+	}
 	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
 		return fmt.Errorf("create repo: mkdir ns: %w", err)
 	}
@@ -139,9 +136,6 @@ func (s *LocalState) CreateRepo(ns, name string) error {
 		return fmt.Errorf("create repo: git init: %w: %s", err, strings.TrimSpace(string(out)))
 	}
 
-	if s.skipAuth {
-		return nil
-	}
 	if _, err := s.engine.Insert(&Repo{
 		NamespaceID: nsID,
 		Namespace:   ns,
@@ -164,12 +158,6 @@ func (s *LocalState) ExistRepo(ns, name string) error {
 // on-disk bare directory. Hard-deletes. skip-auth: disk-only.
 func (s *LocalState) DeleteRepo(ns, name string) error {
 	path, _ := s.RepoPath(ns, name)
-	if s.skipAuth {
-		if path != "" {
-			_ = os.RemoveAll(path)
-		}
-		return nil
-	}
 	r, err := s.findRepo(ns, name)
 	if err != nil {
 		return err
@@ -215,9 +203,6 @@ func (s *LocalState) MoveRepo(old, new string) error {
 	if err := os.Rename(oldPath, newPath); err != nil {
 		return fmt.Errorf("move repo: rename: %w", err)
 	}
-	if s.skipAuth {
-		return nil
-	}
 	r, err := s.findRepo(oldNs, oldName)
 	if err != nil {
 		return err
@@ -261,9 +246,6 @@ func (s *LocalState) MoveNS(old, new string) error {
 	if err := os.Rename(oldDir, newDir); err != nil {
 		return fmt.Errorf("move ns: rename: %w", err)
 	}
-	if s.skipAuth {
-		return nil
-	}
 	if _, err := s.engine.Where("namespace = ?", old).Cols("namespace").Update(&Repo{Namespace: new}); err != nil {
 		_ = os.Rename(newDir, oldDir)
 		return fmt.Errorf("move ns: update: %w", err)

state/ssh.go

@@ -29,9 +29,6 @@ import (
 // (false, ErrDenied) on an unknown key, unknown repo, or insufficient grant.
 // skip-auth allows all.
 func (s *LocalState) AccessBySSHKey(ctx context.Context, key ssh.PublicKey, owner, name string, perm common.Perm) (bool, error) {
-	if s.skipAuth {
-		return true, nil
-	}
 	r, err := s.findRepo(owner, name)
 	if err != nil {
 		if errors.Is(err, ErrRepoNotFound) {
@@ -84,9 +81,6 @@ func (s *LocalState) AccessBySSHKey(ctx context.Context, key ssh.PublicKey, owne
 //
 // skip-auth admits everything (no engine).
 func (s *LocalState) KnownSSHKey(key ssh.PublicKey) (bool, error) {
-	if s.skipAuth {
-		return true, nil
-	}
 	var sk SSHKey
 	has, err := s.engine.Where("fingerprint = ?", fingerprint(key)).Get(&sk)
 	if err != nil {