fix(config): migrate legacy auth and subscription config keys

util/config.go

@@ -299,6 +299,8 @@ type ConfigType struct {
 	TLS  *TLSConfig `json:"tls,omitempty"`
 
 	Mfa *MultifactorAuthConfig `json:"mfa,omitempty"`
+	// Auth is the legacy config key for MFA settings (pre-2.19). Prefer mfa.
+	Auth *MultifactorAuthConfig `json:"auth,omitempty"`
 
 	// Interface ip, put in front of the port.
 	// defaults to empty
@@ -408,6 +410,10 @@ type ConfigType struct {
 	HA *HAConfig `json:"ha,omitempty"`
 
 	Subscription *SubscriptionConfig `json:"subscription,omitempty"`
+	// Legacy flat subscription fields (pre-2.19). Prefer subscription.*.
+	SubscriptionKey       string `json:"subscription_key,omitempty"`
+	SubscriptionKeyFile   string `json:"subscription_key_file,omitempty"`
+	SubscriptionServerURL string `json:"subscription_server_url,omitempty"`
 
 	Dirs *ConfigDirs `json:"dirs,omitempty"`
 
@@ -493,6 +499,7 @@ func ConfigInit(configPath string, noConfigFile bool) (usedConfigPath *string) {
 
 	if !noConfigFile {
 		usedConfigPath = loadConfigFile(configPath)
+		migrateLegacyConfig()
 	}
 
 	loadConfigEnvironment()
@@ -541,6 +548,7 @@ func ConfigInit(configPath string, noConfigFile bool) (usedConfigPath *string) {
 		}
 	}
 
+	ensureSubscriptionConfig()
 	if Config.Subscription.KeyFile != "" {
 		subscriptionKeyBytes, err := os.ReadFile(Config.Subscription.KeyFile)
 		if err != nil {
@@ -553,6 +561,36 @@ func ConfigInit(configPath string, noConfigFile bool) (usedConfigPath *string) {
 	return
 }
 
+// migrateLegacyConfig maps pre-2.19 config keys to their current locations.
+// Must run after loading the config file and before loadConfigEnvironment, which
+// allocates empty nested structs that would otherwise mask unset legacy fields.
+func migrateLegacyConfig() {
+	if Config.Mfa == nil && Config.Auth != nil {
+		Config.Mfa = Config.Auth
+	}
+
+	if Config.SubscriptionKey != "" || Config.SubscriptionKeyFile != "" || Config.SubscriptionServerURL != "" {
+		if Config.Subscription == nil {
+			Config.Subscription = &SubscriptionConfig{}
+		}
+		if Config.Subscription.Key == "" {
+			Config.Subscription.Key = Config.SubscriptionKey
+		}
+		if Config.Subscription.KeyFile == "" {
+			Config.Subscription.KeyFile = Config.SubscriptionKeyFile
+		}
+		if Config.Subscription.ServerURL == "" {
+			Config.Subscription.ServerURL = Config.SubscriptionServerURL
+		}
+	}
+}
+
+func ensureSubscriptionConfig() {
+	if Config.Subscription == nil {
+		Config.Subscription = &SubscriptionConfig{}
+	}
+}
+
 func loadConfigFile(configPath string) (usedConfigPath *string) {
 	if configPath == "" {
 		configPath = os.Getenv("SEMAPHORE_CONFIG_PATH")

util/config_test.go

@@ -495,6 +495,73 @@ func TestLoadConfigFile_JSON(t *testing.T) {
 	assert.Equal(t, ":8888", Config.Port)
 }
 
+func TestMigrateLegacyConfig_AuthToMfa(t *testing.T) {
+	Config = &ConfigType{
+		Auth: &MultifactorAuthConfig{
+			Totp: &TotpConfig{Enabled: true, AllowRecovery: true},
+		},
+	}
+
+	migrateLegacyConfig()
+
+	require.NotNil(t, Config.Mfa)
+	require.NotNil(t, Config.Mfa.Totp)
+	assert.True(t, Config.Mfa.Totp.Enabled)
+	assert.True(t, Config.Mfa.Totp.AllowRecovery)
+}
+
+func TestMigrateLegacyConfig_MfaTakesPrecedenceOverAuth(t *testing.T) {
+	Config = &ConfigType{
+		Mfa: &MultifactorAuthConfig{
+			Totp: &TotpConfig{Enabled: true},
+		},
+		Auth: &MultifactorAuthConfig{
+			Totp: &TotpConfig{Enabled: false},
+		},
+	}
+
+	migrateLegacyConfig()
+
+	require.NotNil(t, Config.Mfa.Totp)
+	assert.True(t, Config.Mfa.Totp.Enabled)
+}
+
+func TestMigrateLegacyConfig_SubscriptionFields(t *testing.T) {
+	Config = &ConfigType{
+		SubscriptionKey:       "legacy-key",
+		SubscriptionKeyFile:   "/etc/semaphore/subscription.key",
+		SubscriptionServerURL: "https://billing.example.com",
+	}
+
+	migrateLegacyConfig()
+
+	require.NotNil(t, Config.Subscription)
+	assert.Equal(t, "legacy-key", Config.Subscription.Key)
+	assert.Equal(t, "/etc/semaphore/subscription.key", Config.Subscription.KeyFile)
+	assert.Equal(t, "https://billing.example.com", Config.Subscription.ServerURL)
+}
+
+func TestLegacyAuthSurvivesConfigFileLoadAndEnvAllocation(t *testing.T) {
+	Config = new(ConfigType)
+
+	decodeConfig(strings.NewReader(`{
+		"auth": {
+			"totp": {
+				"enabled": true,
+				"allow_recovery": true
+			}
+		}
+	}`), "config.json")
+
+	migrateLegacyConfig()
+	loadConfigEnvironment()
+
+	require.NotNil(t, Config.Mfa)
+	require.NotNil(t, Config.Mfa.Totp)
+	assert.True(t, Config.Mfa.Totp.Enabled)
+	assert.True(t, Config.Mfa.Totp.AllowRecovery)
+}
+
 func TestLoadConfigDefaults(t *testing.T) {
 	Config = new(ConfigType)
 	errMsg := "Failed to load config-default"