From 74e657e9557249b4cfea62862dd8bca9d0439765 Mon Sep 17 00:00:00 2001
From: bischoffjeremy <61356201+bischoffjeremy@users.noreply.github.com>
Date: Tue, 30 Dec 2025 10:32:18 +0100
Subject: [PATCH] fix: update auth priority and fallback logic (#373)

Reordered the auth priority because the old logic was misleading. It
would automatically default to "builtin" mode if credentials existed,
completely ignoring the CWA database even if you wanted to use it. You
wouldn't even notice it was happening until you realized the DB
integration wasn't actually active. This fix ensures explicit CWA auth
takes priority so you don't have to wipe your settings just to switch
methods.

Cheers,

Your swiss librarian ;)
---
 cwa_book_downloader/main.py | 24 ++++++++++--------------
 1 file changed, 10 insertions(+), 14 deletions(-)

diff --git a/cwa_book_downloader/main.py b/cwa_book_downloader/main.py
index 5948a2ef..6464a1c7 100644
--- a/cwa_book_downloader/main.py
+++ b/cwa_book_downloader/main.py
@@ -138,28 +138,24 @@ def clear_failed_logins(username: str) -> None:
 def get_auth_mode() -> str:
     """Determine which authentication mode is active.
 
-    Priority order:
-    1. Built-in credentials (if configured) -> "builtin"
-    2. CWA database (if CWA_DB_PATH is set and exists) -> "cwa"
-    3. No auth required -> "none"
+    Priority: 
+    1. CWA (if enabled in settings and DB path exists)
+    2. Built-in credentials (if configured)
+    3. No auth required or error -> "none"
     """
     from cwa_book_downloader.core.settings_registry import load_config_file
 
-    # Check for built-in credentials first (they take priority)
     try:
         security_config = load_config_file("security")
-        username = security_config.get("BUILTIN_USERNAME")
-        password_hash = security_config.get("BUILTIN_PASSWORD_HASH")
-        if username and password_hash:
+        # 1. Check for explicit CWA auth
+        if security_config.get("USE_CWA_AUTH") and CWA_DB_PATH and os.path.isfile(CWA_DB_PATH):
+            return "cwa"
+        # 2. Check for built-in credentials
+        if security_config.get("BUILTIN_USERNAME") and security_config.get("BUILTIN_PASSWORD_HASH"):
             return "builtin"
     except Exception:
-        pass  # If config can't be loaded, fall through to other methods
+        pass
 
-    # Check for CWA database
-    if CWA_DB_PATH and os.path.isfile(CWA_DB_PATH):
-        return "cwa"
-
-    # No auth configured
     return "none"