feat(auth): allow WebAuthn with disabled local authentication

internal/config/options_parsing_test.go

@@ -1859,6 +1859,21 @@ func TestValidateDisableLocalAuthWithoutAlternative(t *testing.T) {
 	}
 }
 
+func TestValidateDisableLocalAuthWithWebAuthn(t *testing.T) {
+	configParser := NewConfigParser()
+
+	if err := configParser.parseLines([]string{
+		"DISABLE_LOCAL_AUTH=1",
+		"WEBAUTHN=1",
+	}); err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+
+	if err := configParser.options.Validate(); err != nil {
+		t.Fatalf("Unexpected validation error: %v", err)
+	}
+}
+
 func TestValidateDisableLocalAuthWithOAuth2ButNoUserCreation(t *testing.T) {
 	configParser := NewConfigParser()
 	if err := configParser.parseLines([]string{

internal/config/parser.go

@@ -57,8 +57,8 @@ func (c *configOptions) Validate() error {
 	}
 
 	if c.DisableLocalAuth() {
-		if c.OAuth2Provider() == "" && c.AuthProxyHeader() == "" {
-			return errors.New("DISABLE_LOCAL_AUTH is enabled but neither OAUTH2_PROVIDER nor AUTH_PROXY_HEADER is set. Please enable at least one authentication source")
+		if c.OAuth2Provider() == "" && c.AuthProxyHeader() == "" && !c.WebAuthn() {
+			return errors.New("DISABLE_LOCAL_AUTH is enabled but none of OAUTH2_PROVIDER, AUTH_PROXY_HEADER, or WEBAUTHN is set. Please enable at least one authentication source")
 		}
 	}