From d0c5c2971e42961d9f4059ccc6db5052b6de51c1 Mon Sep 17 00:00:00 2001
From: James Maes <james@kof22.com>
Date: Wed, 14 Oct 2026 12:42:58 -0500
Subject: [PATCH] fix(config): startup log lists the effective features (TOKENS
 on by default)

The "Authentik QBit produced" line logged the configured feature set, so
TOKENS (on by default whenever writes are enabled) never appeared.
getEffectiveFeatures() reports what hasFeature() says is on.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../qbits/authentik/AuthentikQBitConfig.java  | 20 +++++++++++++++++++
 .../authentik/AuthentikQBitProducer.java      |  2 +-
 .../authentik/AuthentikQBitConfigTest.java    | 13 ++++++++++++
 3 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitConfig.java b/src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitConfig.java
index 33e5382..33103fa 100644
--- a/src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitConfig.java
+++ b/src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitConfig.java
@@ -452,6 +452,26 @@ public class AuthentikQBitConfig implements QBitConfig
 
 
 
+   /*******************************************************************************
+    ** The features that are actually on: the configured set, plus TOKENS when it
+    ** is on by default (writes enabled, not opted out), minus TOKENS when it is
+    ** listed but off (read only or opted out). This is what hosts see in logs.
+    *******************************************************************************/
+   public java.util.Set<AuthentikFeature> getEffectiveFeatures()
+   {
+      java.util.EnumSet<AuthentikFeature> effective = java.util.EnumSet.noneOf(AuthentikFeature.class);
+      for(AuthentikFeature feature : AuthentikFeature.values())
+      {
+         if(hasFeature(feature))
+         {
+            effective.add(feature);
+         }
+      }
+      return (effective);
+   }
+
+
+
    /*******************************************************************************
     ** Whether a feature is enabled.
     *******************************************************************************/
diff --git a/src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitProducer.java b/src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitProducer.java
index 841755d..661f7cf 100644
--- a/src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitProducer.java
+++ b/src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitProducer.java
@@ -192,7 +192,7 @@ public class AuthentikQBitProducer implements QBitMetaDataProducer<AuthentikQBit
       }
 
       LOG.info("Authentik QBit produced", logPair("version", VERSION), logPair("appKey", qBitConfig.getAppKey()),
-         logPair("features", qBitConfig.getFeatures()), logPair("readOnly", qBitConfig.getReadOnly()));
+         logPair("features", qBitConfig.getEffectiveFeatures()), logPair("readOnly", qBitConfig.getReadOnly()));
       return (new MetaDataProducerMultiOutput());
    }
 
diff --git a/src/test/java/com/kingsrook/qbits/authentik/AuthentikQBitConfigTest.java b/src/test/java/com/kingsrook/qbits/authentik/AuthentikQBitConfigTest.java
index dd49b48..12cb9ef 100644
--- a/src/test/java/com/kingsrook/qbits/authentik/AuthentikQBitConfigTest.java
+++ b/src/test/java/com/kingsrook/qbits/authentik/AuthentikQBitConfigTest.java
@@ -236,4 +236,17 @@ class AuthentikQBitConfigTest
       assertThat(config.getTokenBrokerClientSecret()).isNull();
    }
 
+
+
+   /*******************************************************************************
+    ** The startup log lists TOKENS when it is on by default (writes enabled).
+    *******************************************************************************/
+   @org.junit.jupiter.api.Test
+   void effectiveFeaturesIncludeDefaultTokens()
+   {
+      AuthentikQBitConfig writes = new AuthentikQBitConfig().withFeatures(java.util.EnumSet.of(AuthentikFeature.READ, AuthentikFeature.USERS)).withTokensEnabled(true);
+      org.assertj.core.api.Assertions.assertThat(writes.getEffectiveFeatures()).contains(AuthentikFeature.TOKENS, AuthentikFeature.READ, AuthentikFeature.USERS);
+      AuthentikQBitConfig readOnly = new AuthentikQBitConfig().withFeatures(java.util.EnumSet.of(AuthentikFeature.READ));
+      org.assertj.core.api.Assertions.assertThat(readOnly.getEffectiveFeatures()).containsExactly(AuthentikFeature.READ);
+   }
 }
-- 
2.54.0