fix(cli): accept --auth=false / --auth false (and same for every bool flag)

Operator feedback: someone tried `--auth=false` and `--auth false` to
explicitly disable auth, both errored with "unexpected value 'false'
for '--auth' found". They then read the policy error message — which
described state as "auth=false on a non-loopback bind ..." — and
reasonably mistook that for a CLI hint.

Two changes to make the surface match the expectation.

1. Every `bool` flag in `Config` now accepts:
   - `--flag`           (bare, resolves to true)
   - `--flag=true`
   - `--flag=false`
   - `--flag true`
   - `--flag false`

   Absence still falls through to `default_value_t = false`.

   Implementation: clap's default `bool` action is `SetTrue`, which is
   the bare-`--flag`-only form. Switching to `ArgAction::Set` with
   `num_args = 0..=1` + `default_missing_value = "true"` keeps the
   bare form working and adds the explicit-value forms most operators
   expect from kubectl/helm.

   Applied uniformly to: `trino_ssl`, `trino_tls_no_verify`,
   `trino_allow_plaintext_auth`, `auth`, `allow_insecure_listener`.

2. The policy error for "auth disabled on non-loopback bind" used to
   open with the phrase `--auth=false on a non-loopback bind ...`,
   which reads as if `--auth=false` is a valid CLI flag (the source
   of the original confusion). Reworded to describe the state in
   plain English and lay out the three opt-in choices (loopback,
   `--auth` + TLS, `--allow-insecure-listener`) as a numbered list
   so the user can pick directly. No information lost; clarity
   added.

Verified manually with the gateway binary: all five `--auth`
forms parse, both with and without the surrounding policy gates
firing. Existing policy unit tests (191 passing) unchanged.

Author: lfrancke

src/config.rs

@@ -2,7 +2,19 @@
 // SPDX-License-Identifier: OSL-3.0
 use std::path::PathBuf;
 
-use clap::Parser;
+use clap::{ArgAction, Parser};
+
+// clap's default action for `bool` is `SetTrue`: only the bare `--flag`
+// form is accepted, and `--flag=false` errors out. That's surprising for
+// operators used to `kubectl`/`helm`-style explicit-value flags. Every
+// boolean field below uses `num_args=0..=1` + `default_missing_value="true"`
+// + `ArgAction::Set` so all of these work:
+//   --flag        (bare; resolves to true via default_missing_value)
+//   --flag=true
+//   --flag=false
+//   --flag true   (space-separated)
+//   --flag false
+// Absence falls through to `default_value_t = false`.
 
 /// PostgreSQL-to-Trino gateway configuration.
 // WARNING: Debug is derived for clap compatibility. If credential fields
@@ -47,27 +59,27 @@ pub struct Config {
     pub trino_user: String,
 
     /// Use HTTPS to connect to Trino.
-    #[arg(long, default_value_t = false)]
+    #[arg(long, default_value_t = false, num_args = 0..=1, default_missing_value = "true", action = ArgAction::Set)]
     pub trino_ssl: bool,
 
     /// Skip TLS certificate-chain and hostname verification on the Trino
     /// connection. Useful with self-signed certs in a trusted network.
     /// Only meaningful with `--trino-ssl`.
-    #[arg(long, default_value_t = false)]
+    #[arg(long, default_value_t = false, num_args = 0..=1, default_missing_value = "true", action = ArgAction::Set)]
     pub trino_tls_no_verify: bool,
 
     /// Allow forwarding the PG client's password to Trino over plain
     /// HTTP. Required when `--auth` is on and Trino is reached over HTTP
     /// (`--trino-ssl=false`); without it the Trino client refuses to send
     /// credentials. The password crosses the network in cleartext, so use
     /// only with a loopback or otherwise-trusted Trino endpoint.
-    #[arg(long, default_value_t = false)]
+    #[arg(long, default_value_t = false, num_args = 0..=1, default_missing_value = "true", action = ArgAction::Set)]
     pub trino_allow_plaintext_auth: bool,
 
     /// Require password authentication from PG clients.
     /// Credentials are forwarded to Trino as HTTP Basic auth.
     /// When disabled, connects to Trino with the --trino-user and no password.
-    #[arg(long, default_value_t = false)]
+    #[arg(long, default_value_t = false, num_args = 0..=1, default_missing_value = "true", action = ArgAction::Set)]
     pub auth: bool,
 
     /// Acknowledge that the gateway should accept unauthenticated PG
@@ -76,7 +88,7 @@ pub struct Config {
     /// every network-reachable client gets unauthenticated access to
     /// Trino as `--trino-user`. Use only when Trino itself enforces
     /// authentication or the network is otherwise trusted.
-    #[arg(long, default_value_t = false)]
+    #[arg(long, default_value_t = false, num_args = 0..=1, default_missing_value = "true", action = ArgAction::Set)]
     pub allow_insecure_listener: bool,
 
     /// Maximum number of concurrent PG client connections. Excess

src/policy.rs

@@ -95,10 +95,14 @@ pub fn classify(config: &Config) -> Result<AuthPosture> {
             return Ok(AuthPosture::DisabledOpenBind);
         }
         bail!(
-            "--auth=false on a non-loopback bind ({}) is not allowed by default. \
-             Either pass --auth (and --tls-cert/--tls-key for password protection) \
-             to require authentication, or pass --allow-insecure-listener to \
-             explicitly allow unauthenticated network access.",
+            "auth is disabled and the listen address ({}) is not loopback. \
+             That combination would expose Trino to every network-reachable client \
+             without authentication. Pick one of the following: \
+             (a) bind to 127.0.0.1 / [::1] / localhost for local development; \
+             (b) enable auth with `--auth` plus TLS via `--tls-cert` and `--tls-key`; \
+             (c) explicitly opt in to unauthenticated network access with \
+             `--allow-insecure-listener` (only when Trino itself authenticates \
+             or the network is otherwise trusted).",
             config.listen_addr
         )
     }