Require authentication by default

[gguillemas]

Thank you for submitting this pull request! We really appreciate you spending the time to work on these changes.

What is the motivation?

To prevent SurrealDB users from accidentally allowing unauthenticated access to their server. This is specially relevant for users running SurrealDB in cloud instances with publicly addressable network interfaces.

What does this change do?

Replaces the --auth flag with --unauthenticated, which defaults to false. If no flag is provided, the server will run with authentication and a message will no longer be printed announcing it to the user. If the --unauthenticated flag is provided, the server will run without requiring authentication and a warning will be printed.

What is your testing strategy?

Ensure that existing tests pass.

Is this related to any issues?

No.

Does this change need documentation?

Yes, this needs an update on the CLI documentation page.

• Replace deprecated --auth flag in 2.0 docs.surrealdb.com#549

Have you read the Contributing Guidelines?

• I have read the Contributing Guidelines

[kearfy]

@gguillemas should the flag possibly be --no-auth? I think that would be easier to remember and to type in compared to --unauthenticated

[gguillemas]

@gguillemas should the flag possibly be --no-auth? I think that would be easier to remember and to type in compared to --unauthenticated

I was thinking the same thing originally. However, once I got down to implementing the change, I did not like the double negation of --no-auth being false by default, which may be a bit confusing. More importantly, I think not having authentication (i.e. --no-auth) and allowing unauthenticated access (i.e. --unauthenticated) are different things. I was worried some users would assume that --no-auth would prevent anyone from authenticating, when in reality it does quite the opposite and grants complete unauthenticated access (i.e. without credentials) to anyone.

[emmanuel-keller]

LGTM!