feature: consolidate capability toggles under wave.capabilities.*

[pditommaso]

Summary

Groups Wave's installation-level capability toggles under a single, consistent wave.capabilities.* namespace, and adds a strict environment that disables them all at once for locked-down / regulated deployments.

Previously these landed with inconsistent shapes: wave.allowAnonymous (flat), wave.container.pull.enabled (nested), wave.inject-credentials (flat, top-level), and wave.views.enabled (nested). This unifies them.

Capability	Key (default true)	What false does
Anonymous (unauthenticated) access	wave.capabilities.anonymous-access	Requires authenticated access
Ephemeral pull/augmentation path	wave.capabilities.ephemeral-token	Requests rejected — must use freeze mode
Registry credential brokering on proxy pulls	wave.capabilities.credentials-federation	Wave doesn't inject creds; caller uses own (e.g. IAM role)
HTML view pages under /view/**	wave.capabilities.web-views	ViewController not loaded → 404

All flags default to true (permissive) so existing deployments behave exactly as before. The new strict environment (application-strict.yml, enabled with MICRONAUT_ENVIRONMENTS=strict) sets all four to false.

Changes

• ContainerController — renames wave.container.pull.enabled → wave.capabilities.ephemeral-token (field allowPull → ephemeralToken); reads anonymous access from wave.capabilities.anonymous-access; rejection message updated to reflect the new naming.
• RegistryProxyService — adds wave.capabilities.credentials-federation gating getCredentials on the proxy-pull path.
• ViewController — class-level @Requires(property = 'wave.capabilities.web-views', ...).
• application.yml — new wave.capabilities block with documented defaults.
• application-strict.yml — new env profile disabling all capabilities.
• docs/configuration.md — new Capabilities section documenting all four flags and the strict environment.
• Javadocs and log/error messages updated to the new naming.

Backward compatibility

• Defaults unchanged (all true) — no behavior change for existing installs.

• The legacy wave.allowAnonymous key still works as an undocumented alias: application.yml resolves anonymous-access from ${wave.allowAnonymous:true}, so operators who still set the old key are honored (no default shadows it). Covered by AnonymousAccessLegacyAliasTest:

  wave.allowAnonymous	resolved anonymous-access
  unset	true (default)
  false	false
  true	true

Related PRs

• Renames the key introduced in feature: disable the ability for wave to "pull" images directly #1089 (already merged).
• Supersedes Add global wave.inject-credentials flag to control proxy-pull credential injection #1088 (wave.inject-credentials → wave.capabilities.credentials-federation).
• Supersedes Add global flag to disable Wave HTML view pages #1086 (wave.views.enabled → wave.capabilities.web-views).

Test specs from #1088 and #1086 are reproduced here under the new keys, preserving original authorship.

Testing

./gradlew :test — all pass:

• ContainerControllerTest
• RegistryProxyServiceCredentialsTest
• ViewControllerDisabledTest / ViewControllerEnabledTest
• AnonymousAccessLegacyAliasTest

🤖 Generated with Claude Code

[gavinelder]

I don't feel I deserve the attribution within the codebase the clean improvements to the variable names to declare intent are well thought out and provide a strong level of clarity.