From 3e752780523832bcfe974749049f5e8871ab93b7 Mon Sep 17 00:00:00 2001
From: Marc 'risson' Schmitt <marc.schmitt@risson.space>
Date: Mon, 27 Apr 2026 16:03:55 +0200
Subject: [PATCH] packages/ak-common/config: fix string load broken after
 previous fix (#21854)

---
 packages/ak-common/src/config/mod.rs    | 34 +++++++++++++++++++------
 packages/ak-common/src/config/schema.rs |  7 +++++
 2 files changed, 33 insertions(+), 8 deletions(-)

diff --git a/packages/ak-common/src/config/mod.rs b/packages/ak-common/src/config/mod.rs
index 997b72489d..6e32fa489b 100644
--- a/packages/ak-common/src/config/mod.rs
+++ b/packages/ak-common/src/config/mod.rs
@@ -16,7 +16,10 @@ use url::Url;
 pub mod schema;
 pub use schema::Config;
 
-use crate::arbiter::{Arbiter, Event, Tasks};
+use crate::{
+    arbiter::{Arbiter, Event, Tasks},
+    config::schema::KEYS_TO_PARSE_AS_LIST,
+};
 
 static DEFAULT_CONFIG: &str = include_str!("../../../../authentik/lib/default.yml");
 static CONFIG_MANAGER: OnceLock<ConfigManager> = OnceLock::new();
@@ -75,13 +78,15 @@ impl Config {
                 config_rs::File::from(path.as_path()).format(config_rs::FileFormat::Yaml),
             );
         }
-        builder = builder.add_source(
-            config_rs::Environment::with_prefix("AUTHENTIK")
-                .prefix_separator("_")
-                .separator("__")
-                .try_parsing(true)
-                .list_separator(","),
-        );
+        let mut env_source = config_rs::Environment::with_prefix("AUTHENTIK")
+            .prefix_separator("_")
+            .separator("__")
+            .try_parsing(true)
+            .list_separator(",");
+        for key in KEYS_TO_PARSE_AS_LIST {
+            env_source = env_source.with_list_parse_key(key);
+        }
+        builder = builder.add_source(env_source);
         if let Some(overrides) = overrides {
             builder = builder.add_source(config_rs::File::from_str(
                 &overrides.to_string(),
@@ -532,4 +537,17 @@ mod tests {
             ]
         );
     }
+
+    #[test]
+    fn env_string() {
+        #[expect(unsafe_code, reason = "testing")]
+        // SAFETY: testing
+        unsafe {
+            env::set_var("AUTHENTIK_SECRET_KEY", "my_secret_key");
+        }
+
+        let (config, _) = super::Config::load(&[], None).expect("failed to load config");
+
+        assert_eq!(config.secret_key, "my_secret_key",);
+    }
 }
diff --git a/packages/ak-common/src/config/schema.rs b/packages/ak-common/src/config/schema.rs
index 896a40e100..5d110051d8 100644
--- a/packages/ak-common/src/config/schema.rs
+++ b/packages/ak-common/src/config/schema.rs
@@ -3,6 +3,13 @@ use std::{collections::HashMap, net::SocketAddr, num::NonZeroUsize};
 use ipnet::IpNet;
 use serde::{Deserialize, Serialize};
 
+pub(super) const KEYS_TO_PARSE_AS_LIST: [&str; 4] = [
+    "listen.http",
+    "listen.metrics",
+    "listen.trusted_proxy_cidrs",
+    "log.http_headers",
+];
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Config {
     pub postgresql: PostgreSQLConfig,